CVE-2026-89546

Received Received - Intake

Use-After-Free in Linux Kernel SUNRPC Backchannel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89546

EUVD

EUVD-2026-76457

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a backchannel receive request can complete while the NFS callback service is being torn down. This leads to a race condition where requests may be leaked or improperly handled during service shutdown, potentially causing memory leaks or system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's SUNRPC backchannel handling. Detection requires checking kernel logs for NFS callback service teardown issues or examining kernel version for affected builds. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to memory leaks, system crashes, or denial of service if exploited. It may cause instability in systems using NFS with the Linux kernel, particularly those relying on callback services for remote file operations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. The fix involves closing the backchannel before destroying the callback service. Check your distribution's security advisories for kernel updates addressing CVE-2026-89546.

Hi! I’m here to help you understand CVE-2026-89546. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70