{"id":"CVE-2026-90235","published":"2026-09-17T17:17:19.400","lastModified":"2026-09-18T18:17:48.413","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE\n\nxprtsock replaces and restores sk->sk_data_ready and\nsk->sk_write_space on live sockets with plain stores, and\nxs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain\nload. These callback pointers are shared with generic socket and\nprotocol paths that may read or invoke them concurrently, so xprtsock\nneeds the same READ_ONCE()/WRITE_ONCE() callback visibility contract\nthat the validated 4022 family applied elsewhere.\n\nWhen SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later\nrestores the lower-socket callbacks during teardown, another CPU may\nstill hold an earlier callback snapshot. The plain replace/restore\npattern leaves the same visibility hole as the validated 4022 family,\nso a stale snapshot can still invoke xs_data_ready() or\nxs_udp_write_space() after the live callback fields have already been\nrestored to the lower-socket handlers.\n\nUse WRITE_ONCE() for the shared sk_data_ready and sk_write_space\nstores in xs_local_finish_connecting(), xs_udp_finish_connecting(),\nxs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use\nREAD_ONCE() for the direct sk_write_space invocation in\nxs_udp_do_set_buffer_size(). This matches the required callback\nvisibility contract while leaving adjacent sk_state_change and\nsk_error_report handling unchanged.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481","tags":[]},{"url":"https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe","tags":[]},{"url":"https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43","tags":[]},{"url":"https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664","tags":[]},{"url":"https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in the Linux kernel's sunrpc module allows for potential race conditions when handling socket callbacks, leading to possible data corruption or denial of service.","exploitability":"Exploitation requires concurrent access to the socket callbacks and is moderately difficult due to the need for precise timing and coordination between threads.","blast_radius":"If exploited, the vulnerability could lead to data corruption or denial of service for services relying on the affected sockets.","remediation":"Upgrade to the specific version 5.19.1 or later, as published in the advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","race-condition","socket","data-corruption"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-27T09:02:37.469Z"}}