« Volver al listado

CVE-2026-89536

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: wait for in-flight client TLS handshake callback

xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel().

handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference.

Leer descripción completaMostrar menos

If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad crítica en kernel Linux (AV:N, PR:N, UI:N) que afecta gestión de handshake TLS en SUNRPC, explotable remotamente. La race condition puede causar corrupción de memoria y escalada de privilegios o denegación de servicio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89536",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "lessThan": "fb43997407bc17ee39bac81ab708101312e255f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "lessThan": "15431820f448e09f8029b670d5c82aa5917d4625",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "lessThan": "1de391e8b94e31b45c19c16dbf315e294810c7de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "lessThan": "7fbb6d2ab0391eb8d1f1a68e6bc263ef02cea61b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75eb6af7acdf566c68d61e98e67ee2f235201c02",
              "lessThan": "a89dd597458848b463d284b15e42a8078beeb046",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/sunrpc/xprtsock.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/sunrpc/xprtsock.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:36.613",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/15431820f448e09f8029b670d5c82aa5917d4625",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1de391e8b94e31b45c19c16dbf315e294810c7de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7fbb6d2ab0391eb8d1f1a68e6bc263ef02cea61b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a89dd597458848b463d284b15e42a8078beeb046",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fb43997407bc17ee39bac81ab708101312e255f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: wait for in-flight client TLS handshake callback\n\nxs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the\nlower transport before submitting the handshake request. On timeout or\nsignal, the synchronous waiter drops that reference after calling\ntls_handshake_cancel().\n\nhandshake_req_cancel() returns false when handshake_complete() has\nalready marked the request complete. In that case the completion callback\ncan still be running, so dropping the callback-owned reference in the\nwaiter can free the lower transport before xs_tls_handshake_done() stores\nxprt_err or drops its own reference.\n\nIf cancellation loses to completion, wait until xs_tls_handshake_done()\nsignals handshake_done and let the callback release its reference. This\nmirrors the server-side handshake lifetime handling and keeps the timeout\nor signal return value unchanged."
    }
  ],
  "lastModified": "2026-09-14T13:19:08.727",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}