CVE-2026-90235

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

xprtsock replaces and restores sk->sk_data_ready and

sk->sk_write_space on live sockets with plain stores, and

xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain

load. These callback pointers are shared with generic socket and

protocol paths that may read or invoke them concurrently, so xprtsock

needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract

that the validated 4022 family applied elsewhere.

When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later

restores the lower-socket callbacks during teardown, another CPU may

still hold an earlier callback snapshot. The plain replace/restore

pattern leaves the same visibility hole as the validated 4022 family,

so a stale snapshot can still invoke xs_data_ready() or

xs_udp_write_space() after the live callback fields have already been

restored to the lower-s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References