GHSA-GWH2-5395-P8P6
Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-14 15:32In the Linux kernel, the following vulnerability has been resolved:
sunrpc: init gssp_lock before publishing proc entry
create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before init_gssp_clnt() runs mutex_init() on sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is immediately reachable from userspace, so a write that lands in the window drives set_gssp_clnt() into mutex_lock() on a zero-initialized struct mutex.
create_use_gss_proxy_proc_entry(net)
proc_create_data("use-gss-proxy", ...) /* dentry live */
init_gssp_clnt(sn)
mutex_init(&sn->gssp_lock) /* too late */
write_gssp()
set_gssp_clnt(net)
mutex_lock(&sn->gssp_lock) /* uninitialized */
gssp_rpc_create(...)
sn->gssp_clnt = clnt
mutex_unlock(&sn->gssp_lock)
The window spans only the two statements between proc_create_data() returning and init_gssp_clnt(), so a writer reaches it only if the registering thread is preempted there while another task is already opening the freshly published file. register_pernet_subsys() runs in preemptible context under pernet_ops_rwsem, so that preemption is possible, and the window widens on auth_rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. A writer that wins the race locks a zero-filled struct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a "lock used without init" splat; on a production kernel the fast path acquires the lock via CMPXCHG(owner, 0, current). In the latter case a second writer that arrives before init_gssp_clnt() re-zeroes owner can enter set_gssp_clnt() concurrently, shut down the first writer's clnt while it is still in use, and leak the loser's clnt.
Fix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime matches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from the kzalloc that backs net_generic storage, so the lazy helper is no longer needed; drop init_gssp_clnt(), its prototype, and the call from create_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time dependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on every netns before any auth_gss pernet init can publish the proc entry.
{
"affected": [],
"aliases": [
"CVE-2026-89540"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T20:19:37Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: init gssp_lock before publishing proc entry\n\ncreate_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy\nvia proc_create_data() before init_gssp_clnt() runs mutex_init() on\nsn-\u003egssp_lock. Once the dentry is linked under proc_subdir_lock it is\nimmediately reachable from userspace, so a write that lands in the\nwindow drives set_gssp_clnt() into mutex_lock() on a zero-initialized\nstruct mutex.\n\n create_use_gss_proxy_proc_entry(net)\n proc_create_data(\"use-gss-proxy\", ...) /* dentry live */\n init_gssp_clnt(sn)\n mutex_init(\u0026sn-\u003egssp_lock) /* too late */\n\n write_gssp()\n set_gssp_clnt(net)\n mutex_lock(\u0026sn-\u003egssp_lock) /* uninitialized */\n gssp_rpc_create(...)\n sn-\u003egssp_clnt = clnt\n mutex_unlock(\u0026sn-\u003egssp_lock)\n\nThe window spans only the two statements between proc_create_data()\nreturning and init_gssp_clnt(), so a writer reaches it only if the\nregistering thread is preempted there while another task is already\nopening the freshly published file. register_pernet_subsys() runs in\npreemptible context under pernet_ops_rwsem, so that preemption is\npossible, and the window widens on auth_rpcgss module load, when the\nproc entry is created for every live net namespace whose tasks are\nalready running. A writer that wins the race locks a zero-filled\nstruct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a\n\"lock used without init\" splat; on a production kernel the fast path\nacquires the lock via CMPXCHG(owner, 0, current). In the latter case\na second writer that arrives before init_gssp_clnt() re-zeroes owner\ncan enter set_gssp_clnt() concurrently, shut down the first writer\u0027s\nclnt while it is still in use, and leak the loser\u0027s clnt.\n\nFix by initializing sn-\u003egssp_lock in sunrpc_init_net() so its lifetime\nmatches the sunrpc_net it lives in. sn-\u003egssp_clnt is already NULL from\nthe kzalloc that backs net_generic storage, so the lazy helper is no\nlonger needed; drop init_gssp_clnt(), its prototype, and the call from\ncreate_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time\ndependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on\nevery netns before any auth_gss pernet init can publish the proc\nentry.",
"id": "GHSA-gwh2-5395-p8p6",
"modified": "2026-09-14T15:32:28Z",
"published": "2026-09-11T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89540"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/159a4fab7170badd6c4a553aef81cac079d6f4ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f019571928b269feebcff59926ec13294215e0e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5ce1ed6159731a41fdd0b03eedbed4e147036a5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f5bcdc8da15077ebe846c2756a5a17741021410"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89c8e0733e8c46b7973503f15b1b31a8587d8030"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3526ae3351968f6726bcbe25d8d09973ad79109"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/edeefb111d6181a4aa278f415b005efe284b9489"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f15b87521168c2a92cb1931f532cba422f856f01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.