GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89546 (GCVE-0-2026-89546)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
SUNRPC: close backchannel before destroying callback service
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 441244d4273a8037b265fd254dfdaca5fa736ee2 , < 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8 (git)
Affected: 441244d4273a8037b265fd254dfdaca5fa736ee2 , < 3674f780f47d2906b5a0f7199b66973067bdfeca (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback.c",
            "include/linux/sunrpc/bc_xprt.h",
            "net/sunrpc/backchannel_rqst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6debde9e3e6ae21dcca75837b4247b13ca4ea2b8",
              "status": "affected",
              "version": "441244d4273a8037b265fd254dfdaca5fa736ee2",
              "versionType": "git"
            },
            {
              "lessThan": "3674f780f47d2906b5a0f7199b66973067bdfeca",
              "status": "affected",
              "version": "441244d4273a8037b265fd254dfdaca5fa736ee2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback.c",
            "include/linux/sunrpc/bc_xprt.h",
            "net/sunrpc/backchannel_rqst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: close backchannel before destroying callback service\n\nA backchannel receive can complete a request while the NFS callback\nservice is being torn down.  xprt_complete_bc_request() removes the\nrequest from bc_pa_list, drops bc_alloc_count, marks the request in use,\nand then asks xprt_enqueue_bc_request() to hand it to the callback\nservice.\n\nIf teardown has already cleared xprt-\u003ebc_serv, xprt_enqueue_bc_request()\ncurrently returns without enqueueing or freeing the committed request.\nThe xprt_get() taken on entry is leaked as well.  If the producer wins\nthe race before bc_serv is cleared, it can also enqueue onto sv_cb_list\nafter nfs_callback_down() has stopped the callback threads, leaving the\nrequest linked to a svc_serv that is about to be freed.\n\nClose the producer side before callback threads are stopped.  Add\nxprt_svc_shutdown_bc() to clear xprt-\u003ebc_serv under bc_pa_lock, and call\nit on callback shutdown and callback-start failure before stopping the\nservice threads.  Requests that lose the NULL transition in\nxprt_enqueue_bc_request() are released through the normal backchannel\nfree path after balancing bc_slot_count.  Finally, drain any remaining\nsv_cb_list requests after the callback threads have stopped and before\nsvc_destroy() frees the service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The producer is xs_read_stream_call()/rpcrdma_bc_receive_call() handling RPC_CALL messages on the established NFSv4.1+ client TCP or RPC/RDMA transport; a malicious NFS server sends backchannel frames on that connection and reaches the bug without local access.\nAC:L - The attacker controls both sides of the race: they emit backchannel RPC_CALLs on the still-live xprt and force callback teardown via failed session setup, autofs expiry, or unmount, leaving rpc_rqst objects on sv_cb_list when svc_destroy() frees svc_serv.\nPR:N - A remote NFS peer needs no account or capability on the victim; backchannel RPC_CALLs are accepted on the connected NFSv4.1+ transport once a mount or mount attempt exists, with no local privileges at exploit time.\nUI:N - Boot-time, autofs, and Kubernetes NFSv4.1+ mounts are common; after that session exists the attacker drives backchannel traffic and callback teardown without further interactive victim action such as a manual mount.\nS:U - The use-after-free corrupts the in-kernel nfs_callback svc_serv and rpc_rqst objects on the client host and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - A raced enqueue leaves an in-use rpc_rqst linked into a freed svc_serv (sv_cb_list/sv_pools), and unlocked bc_serv readers can follow that dangling pointer, yielding a kernel-heap use-after-free read primitive.\nI:H - Use-after-free of svc_serv with queued rpc_rqst and svc_pool_wake_idle_thread on dying callback pools enables heap reuse of RPC service control structures, a standard kernel write and control-flow hijack primitive.\nA:H - svc_destroy() of a callback service that still has live backchannel requests, plus dereference of xprt-\u003ebc_serv after free, causes kernel oops or panic; the leak path also orphans rpc_rqst objects and xprt references."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:45.511Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6debde9e3e6ae21dcca75837b4247b13ca4ea2b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3674f780f47d2906b5a0f7199b66973067bdfeca"
        }
      ],
      "title": "SUNRPC: close backchannel before destroying callback service",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89546",
    "datePublished": "2026-09-11T19:44:21.898Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-09-13T06:30:45.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89546",
      "date": "2026-09-16",
      "epss": "0.00516",
      "percentile": "0.42644"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89546\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:37.960\",\"lastModified\":\"2026-09-13T07:17:16.950\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: close backchannel before destroying callback service\\n\\nA backchannel receive can complete a request while the NFS callback\\nservice is being torn down.  xprt_complete_bc_request() removes the\\nrequest from bc_pa_list, drops bc_alloc_count, marks the request in use,\\nand then asks xprt_enqueue_bc_request() to hand it to the callback\\nservice.\\n\\nIf teardown has already cleared xprt-\u003ebc_serv, xprt_enqueue_bc_request()\\ncurrently returns without enqueueing or freeing the committed request.\\nThe xprt_get() taken on entry is leaked as well.  If the producer wins\\nthe race before bc_serv is cleared, it can also enqueue onto sv_cb_list\\nafter nfs_callback_down() has stopped the callback threads, leaving the\\nrequest linked to a svc_serv that is about to be freed.\\n\\nClose the producer side before callback threads are stopped.  Add\\nxprt_svc_shutdown_bc() to clear xprt-\u003ebc_serv under bc_pa_lock, and call\\nit on callback shutdown and callback-start failure before stopping the\\nservice threads.  Requests that lose the NULL transition in\\nxprt_enqueue_bc_request() are released through the normal backchannel\\nfree path after balancing bc_slot_count.  Finally, drain any remaining\\nsv_cb_list requests after the callback threads have stopped and before\\nsvc_destroy() frees the service.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/callback.c\",\"include/linux/sunrpc/bc_xprt.h\",\"net/sunrpc/backchannel_rqst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"441244d4273a8037b265fd254dfdaca5fa736ee2\",\"lessThan\":\"6debde9e3e6ae21dcca75837b4247b13ca4ea2b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"441244d4273a8037b265fd254dfdaca5fa736ee2\",\"lessThan\":\"3674f780f47d2906b5a0f7199b66973067bdfeca\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/callback.c\",\"include/linux/sunrpc/bc_xprt.h\",\"net/sunrpc/backchannel_rqst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3674f780f47d2906b5a0f7199b66973067bdfeca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6debde9e3e6ae21dcca75837b4247b13ca4ea2b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:57:19+00:00",
      "cve": "CVE-2026-89546",
      "id": "CVE-2026-89546",
      "initial_release_date": "2026-09-11T19:44:21.898000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux Kernel: Resource management flaw in SUNRPC NFS callback service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89546.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:02:09Z",
      "cve": "CVE-2026-89546",
      "id": "CVE-2026-89546",
      "initial_release_date": "2026-09-16T00:02:09Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89546",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89546.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.