DEBIAN-CVE-2026-90235

In the Linux kernel, the following vulnerability has been resolved:  sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE  xprtsock replaces and restores sk->skdataready and sk->skwritespace on live sockets with plain stores, and xsudpdosetbuffersize() invokes sk->skwritespace via a plain load. These callback pointers are shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs the same READONCE()/WRITEONCE() callback visibility contract that the validated 4022 family applied elsewhere.  When SUNRPC takes over an AFLOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot can still invoke xsdataready() or xsudpwritespace() after the live callback fields have already been restored to the lower-socket handlers.  Use WRITEONCE() for the shared skdataready and skwritespace stores in xslocalfinishconnecting(), xsudpfinishconnecting(), xstcpfinishconnecting(), and xsrestoreoldcallbacks(). Use READONCE() for the direct skwritespace invocation in xsudpdosetbuffersize(). This matches the required callback visibility contract while leaving adjacent skstatechange and skerrorreport handling unchanged.