# CVE-2026-89536

## Summary

- **CVE ID:** CVE-2026-89536
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: wait for in-flight client TLS handshake callback

xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the
lower transport before submitting the handshake request. On timeout or
signal, the synchronous waiter drops that reference after calling
tls_handshake_cancel().

handshake_req_cancel() returns false when handshake_complete() has
already marked the request complete. In that case the completion callback
can still be running, so dropping the callback-owned reference in the
waiter can free the lower transport before xs_tls_handshake_done() stores
xprt_err or drops its own reference.

If cancellation loses to completion, wait until xs_tls_handshake_done()
signals handshake_done and let the callback release its reference. This
mirrors the server-side handshake lifetime handling and keeps the timeout
or signal return value unchanged.

## Affected Products

- Linux — Linux (75eb6af7acdf566c68d61e98e67ee2f235201c02)
- Linux — Linux (6.5)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/15431820f448e09f8029b670d5c82aa5917d4625)
- [CNA](https://git.kernel.org/stable/c/1de391e8b94e31b45c19c16dbf315e294810c7de)
- [CNA](https://git.kernel.org/stable/c/7fbb6d2ab0391eb8d1f1a68e6bc263ef02cea61b)
- [CNA](https://git.kernel.org/stable/c/a89dd597458848b463d284b15e42a8078beeb046)
- [CNA](https://git.kernel.org/stable/c/fb43997407bc17ee39bac81ab708101312e255f5)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.63%
- **EPSS Percentile:** 48.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._