External risk intelligence

Linux Kernel SUNRPC Client TLS Handshake Race Condition

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89536

This vulnerability exists within the Linux kernel SUNRPC TLS handshake implementation. It concerns low-level internal kernel memory management and reference counting for transport callbacks. This code is not directly exposed to or reachable by external network traffic in a way that provides an attack surface for public internet-facing services.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's SUNRPC component could potentially impact secure communication. The issue relates to how the kernel handles client TLS handshakes, specifically concerning the timing of reference counting during handshake callbacks.

Kernel handshake issue may affect secure connections.
High severity; verify if affected.
Confirm relevance to confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a specific race condition within the Linux kernel's SUNRPC component during a TLS handshake. This could occur if a client-side TLS handshake request times out or is signaled to cancel while a completion callback is still active. Successful exploitation could lead to a crash or compromise of the system.

Entry condition: Network access to a vulnerable system.
Trigger point: A race condition during TLS handshake cancellation.
Resulting risk: System instability or compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the stability of the SUNRPC TLS handshake process within the Linux kernel. If a timeout or signal occurs during the handshake, a race condition could lead to a premature release of a transport reference, potentially causing a crash or unexpected behavior when the handshake completes. No specific system data, user data, or PII is indicated as directly at risk.

Kernel transport reference could be freed.
Race condition during handshake cancellation.
System instability or crash may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SUNRPC component impacts core networking functionality, making it a concern for infrastructure and platform teams responsible for kernel operations. The initial focus should be on identifying all systems running the affected kernel version, assessing their exposure to the internet, and pinpointing the system owners responsible for remediation. Planning for updates or mitigation should then proceed based on the criticality and reachability of these systems.

Infrastructure and platform teams own this.
Verify affected kernel deployments and exposure.
Plan and coordinate kernel maintenance or updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SUNRPC component?

The SUNRPC (Sun Remote Procedure Call) component is a fundamental part of the Linux kernel that enables network communication between client and server systems. It is primarily used to support protocols like NFS (Network File System), allowing computers to share resources and data across a network. This specific vulnerability involves how that component manages secure, encrypted TLS connections during the initial handshake process.

How does CVE-2026-89536 work?

This vulnerability involves a race condition, which occurs when a system attempts to perform two tasks at the exact same time, leading to unexpected results. In this case, the kernel struggles to track the memory 'reference' for a connection when a TLS handshake is canceled simultaneously with the handshake completing. Because the kernel prematurely releases this reference, it can lead to memory errors, potentially causing the system to crash or behave unpredictably.

When does this vulnerability get triggered?

A trigger requires a precise conflict during the TLS handshake process, specifically when a request times out or receives a cancellation signal exactly as the handshake callback is finishing. It is not triggered by standard, successful encrypted connections that complete without interruption. If the handshake process does not encounter a timeout or an active signal to cancel, the specific race condition that leads to this memory management error will not occur.

Do I need to worry if my systems are internal?

Halo Surface Signal indicates this vulnerability is unlikely to be a direct target for public internet-facing services because it involves deep, internal kernel operations. While the CVSS severity is high, the complexity of the race condition and its location within the kernel's internal memory management make it difficult to exploit remotely. However, you should still prioritize monitoring systems that handle critical network communication, regardless of their location.

How should I respond to this vulnerability?

Begin by auditing your infrastructure to identify which systems are running the affected Linux kernel versions. Since this resides in the kernel, remediation will typically involve applying kernel security updates provided by your distribution vendor. Coordinate with your platform and infrastructure teams to test and deploy these updates, as changes to kernel networking components require careful planning to maintain system stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.