Cloudanix VulnDB

CVE-2026-89546

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's network file sharing code can let the system crash or become unstable when handling certain network requests during shutdown.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition during NFS callback service teardown allows a backchannel request to be enqueued after threads are stopped or to leak references when bc_serv is cleared, leaving requests linked to a soon-to-be-freed svc_serv.

Why it matters to the business

Kernel crashes, memory corruption, or denial of service on NFS servers can interrupt file services and force unplanned reboots or maintenance windows.

How an attack unfolds

An attacker triggers concurrent backchannel request completion while the NFS callback service is being torn down, winning a race that either leaks kernel references or enqueues work onto a destroyed service structure, leading to use-after-free or panic.

How to fix it

Apply the upstream fix that adds xprt_svc_shutdown_bc before stopping callback threads and drains sv_cb_list after thread exit; rebuild and deploy updated kernel packages containing the resolution.

How to confirm the fix worked

Confirm the patch is present by inspecting the SUNRPC backchannel shutdown code path for the new xprt_svc_shutdown_bc call and verify no bc_pa_list leaks under concurrent callback teardown stress tests.

Typical attack path

  1. Establish NFS mount with callback channel
  2. Trigger service teardown via unmount or error path
  3. Race xprt_complete_bc_request against nfs_callback_down
  4. Cause request to reference freed svc_serv or leak bc_alloc_count
  5. Trigger kernel panic or memory corruption on subsequent operations

How to detect it

Search kernel logs and dmesg for oops traces mentioning xprt_enqueue_bc_request, bc_pa_list, or nfs_callback_down during service teardown; review audit logs for unusual NFS unmount or error patterns coinciding with crashes.

What your security team should do

  • Prioritize kernel updates on all NFS servers within the next maintenance cycle
  • Monitor for kernel oops or panic logs referencing svc_serv or bc_pa_list
  • Limit NFS callback exposure by using firewall rules where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.

Affected packages

Ecosystem Package Introduced Fixed