{"cve":"CVE-2026-90235","nvd":{"published":"2026-09-17T17:17:19.400","modified":"2026-10-19T09:19:13.947","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE\n\nxprtsock replaces and restores sk->sk_data_ready and\nsk->sk_write_space on live sockets with plain stores, and\nxs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain\nload. These callback pointers are shared with generic socket and\nprotocol paths that may read or invoke them concurrently, so xprtsock\nneeds the same READ_ONCE()/WRITE_ONCE() callback visibility contract\nthat the validated 4022 family applied elsewhere.\n\nWhen SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later\nrestores the lower-socket callbacks during teardown, another CPU may\nstill hold an earlier callback snapshot. The plain replace/restore\npattern leaves the same visibility hole as the validated 4022 family,\nso a stale snapshot can still invoke xs_data_ready() or\nxs_udp_write_space() after the live callback fields have already been\nrestored to the lower-socket handlers.\n\nUse WRITE_ONCE() for the shared sk_data_ready and sk_write_space\nstores in xs_local_finish_connecting(), xs_udp_finish_connecting(),\nxs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use\nREAD_ONCE() for the direct sk_write_space invocation in\nxs_udp_do_set_buffer_size(). This matches the required callback\nvisibility contract while leaving adjacent sk_state_change and\nsk_error_report handling unchanged.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481","https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe","https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43","https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664","https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90235","score":0.00618,"percentile":0.49317,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}