Cloudanix VulnDB

CVE-2026-89547

High · 8.1

CVSS

8.1

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing code can corrupt memory inside the operating system when an administrator starts the service while the machine is low on memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Failure to validate percpu_counter_init return values in __svc_create leaves per-pool counters with NULL backing storage; subsequent hot-path accesses in svc_xprt_enqueue, svc_handle_xprt and svc_pool_wake_idle_thread plus pool_stats reads perform offset-zero writes and reads into the current CPU's per-CPU area, corrupting adjacent kernel variables and triggering uninitialized spinlock usage.

Why it matters to the business

NFS, lockd and NFS callback services started under memory pressure can silently corrupt kernel memory, produce garbage statistics, or panic on debug kernels, forcing unplanned reboots and potential loss of file-serving availability for any organization running the affected kernel.

How an attack unfolds

A local administrator induces memory pressure or uses fault injection during RPC server initialization so that one or more percpu_counter allocations fail; the half-initialized svc_serv is still returned and activated, after which normal NFS traffic or a pool_stats read reaches the NULL per-CPU pointer and corrupts live kernel data.

How to fix it

Apply the upstream fix that checks every percpu_counter_init return value inside __svc_create, unwinds partially initialized pools on failure, and calls percpu_counter_destroy on teardown; reboot into the patched kernel.

How to confirm the fix worked

Inspect kernel source for the added return-value checks and unwind logic in __svc_create; confirm absence of uninitialized-spinlock warnings on debug kernels and that pool_stats output is consistent after service restart under memory pressure.

Typical attack path

  1. Obtain local administrator shell on a Linux system running an unpatched kernel
  2. Create memory pressure or enable fault injection
  3. Start or restart nfsd, lockd or the NFS callback service
  4. Exercise RPC paths or read /proc/fs/nfsd/pool_stats
  5. Trigger memory corruption, statistics corruption or debug-kernel splat

How to detect it

Search kernel logs for uninitialized spinlock or lockdep warnings referencing percpu_counter or svc_pool structures; inspect /proc/fs/nfsd/pool_stats output for obviously invalid values after service startup under memory pressure.

  • uninitialized spinlock
  • percpu_counter
  • /proc/fs/nfsd/pool_stats

What your security team should do

  • Patch and reboot all Linux systems exposing NFS services within the next maintenance window
  • Add kernel memory-pressure and allocation-failure monitoring to detect startup conditions that could trigger the bug
  • Restrict local administrative access to systems running unpatched kernels until remediation is complete

The record

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-pool percpu_counter stats and ignores every return value. On SMP, percpu_counter_init() fails when __alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed counter with fbc->counters == NULL and its embedded raw_spinlock_t, list_head, and count never initialized. __svc_create() returns the half-constructed svc_serv to nfsd, lockd, or the NFS callback service anyway. Once that service is live, the hot-path increments in svc_xprt_enqueue(), svc_handle_xprt(), and svc_pool_wake_idle_thread() reach a counter whose backing pointer is NULL. The pointer is a per-cpu offset, so the access does not fault: it resolves to offset zero of the current CPU's per-cpu area and silently corrupts whatever variable lives there. A /proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and returns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on the never-initialized lock. Creating the broken service requires a percpu allocation failure during RPC server startup, so it is reachable only by a local administrator under memory pressure or fault injection; a remote peer cannot induce the bad state on its own. Check each percpu_counter_init() return value in __svc_create() and fail when an allocation fails, unwinding the counters already set up in the current pool and in every pool initialized before it. A discrete percpu_counter_destroy() per counter at teardown frees each per-cpu allocation exactly once.

Affected packages

Ecosystem Package Introduced Fixed