CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Normal client creation goes through rpc_setup_pipedir(), which records

clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event()

calls rpc_setup_pipedir_sb() directly and never refreshes that field.

The umount path also removes the directory without clearing

clnt->pipefs_sb.

After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()

compares the current superblock against a stale pipefs_sb pointer and

skips cleanup, leaving pipefs dentries whose inode private data still

points at a freed rpc_clnt, leading to a potential use-after-free during

subsequent rpc_info_open() or rpc_show_info() calls.

Fix this by properly updating clnt->pipefs_sb upon mount events and

clearing it during unmount or failure paths.