CVE-2026-89549 (GCVE-0-2026-89549)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
sunrpc: route to a populated pool in svc_pool_for_cpu()
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely. Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race().
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < 9accc25e5af0bac8479f6054e674b2c593c45281 (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < 6f66d38e2a6c78d48723ea17ad86135ec80ca24b (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < edb20e8c03aebacb409968c99d046f509c6c485a (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < 011479cf9a7657d4a3e7cc42a784ac63df594170 (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < 9d04d64ad192439835ed9884d767353061c3ed6f (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < 8f766d2d0b4dabf54f8b35812df2b4f481d13316 (git)
Affected: bfd241600a3b0db4fe43c859f1460d0a958d924a , < f6310491c4cdb88af73aa551ec9df1f10a90c709 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9accc25e5af0bac8479f6054e674b2c593c45281",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "6f66d38e2a6c78d48723ea17ad86135ec80ca24b",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "edb20e8c03aebacb409968c99d046f509c6c485a",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "011479cf9a7657d4a3e7cc42a784ac63df594170",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "9d04d64ad192439835ed9884d767353061c3ed6f",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "8f766d2d0b4dabf54f8b35812df2b4f481d13316",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "f6310491c4cdb88af73aa551ec9df1f10a90c709",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: route to a populated pool in svc_pool_for_cpu()\n\nsvc_set_num_threads() spreads the requested threads evenly across the\nservice\u0027s pools (base = nrservs / sv_nrpools).  When a service runs\nfewer threads than it has pools -- e.g. an nfsd configured with fewer\nthreads than the host has NUMA nodes while running in \"pernode\" or\n\"percpu\" mode -- the trailing pools are left with no threads at all.\n\nsvc_xprt_enqueue() selects a pool from the CPU servicing the transport,\nqueues the transport on that pool\u0027s sp_xprts, and only wakes a thread\nfrom the same pool.  Each thread services exclusively its own pool, so a\ntransport that lands on a threadless pool is enqueued on sp_xprts and\nnever picked up: the connection hangs indefinitely.\n\nHave svc_pool_for_cpu() skip pools that currently have no threads,\nfalling back to the next populated pool.  This trades NUMA locality for\na guarantee that the work is actually serviced.  sp_nrthreads is only\nupdated under the service mutex; the lockless read here is a best-effort\nrouting hint, so annotate it with data_race()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd is the in-kernel NFS server; inbound TCP/UDP/RDMA traffic hits svc_tcp_listen_data_ready/svc_data_ready then svc_xprt_enqueue() and svc_pool_for_cpu() before any RPC decode, so a remote peer reaches the bug over the wire.\nAC:L - On NUMA nfsd hosts using pernode/percpu pools with fewer threads than pools, a remote peer can open connections or send datagrams until RSS/softirq lands the listener or shared UDP xprt on an empty pool; the attacker controls that fan-out and no race or layout luck is required.\nPR:N - Enqueue runs in the socket data_ready path on the first TCP connect or UDP datagram to nfsd, before RPC parsing or AUTH_SYS/RPCSEC_GSS, so an unauthenticated network peer needs no local account or capability.\nUI:N - No victim action is required; an already-running NFS server automatically processes inbound connections and packets through the sunrpc transport callbacks.\nS:U - The hang is confined to the host kernel\u0027s sunrpc/nfsd threads and sockets and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - This is a transport-scheduling hang with no memory corruption, out-of-bounds access, or other primitive that could disclose kernel or file data.\nI:N - A transport stuck on a threadless pool is never serviced, so RPC operations are not executed and no kernel or filesystem state is modified.\nA:H - A transport enqueued on a threadless pool stays XPT_BUSY and is never dequeued; aging skips busy sockets, so a stuck listener or shared UDP xprt permanently stops NFS accept/recv until nfsd restarts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:52.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9accc25e5af0bac8479f6054e674b2c593c45281"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f66d38e2a6c78d48723ea17ad86135ec80ca24b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f"
        },
        {
          "url": "https://git.kernel.org/stable/c/edb20e8c03aebacb409968c99d046f509c6c485a"
        },
        {
          "url": "https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709"
        }
      ],
      "title": "sunrpc: route to a populated pool in svc_pool_for_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89549",
    "datePublished": "2026-09-11T19:44:23.928Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-09-14T12:00:52.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89549",
      "date": "2026-09-15",
      "epss": "0.00716",
      "percentile": "0.51888"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89549\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:38.373\",\"lastModified\":\"2026-09-14T13:19:09.857\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsunrpc: route to a populated pool in svc_pool_for_cpu()\\n\\nsvc_set_num_threads() spreads the requested threads evenly across the\\nservice\u0027s pools (base = nrservs / sv_nrpools).  When a service runs\\nfewer threads than it has pools -- e.g. an nfsd configured with fewer\\nthreads than the host has NUMA nodes while running in \\\"pernode\\\" or\\n\\\"percpu\\\" mode -- the trailing pools are left with no threads at all.\\n\\nsvc_xprt_enqueue() selects a pool from the CPU servicing the transport,\\nqueues the transport on that pool\u0027s sp_xprts, and only wakes a thread\\nfrom the same pool.  Each thread services exclusively its own pool, so a\\ntransport that lands on a threadless pool is enqueued on sp_xprts and\\nnever picked up: the connection hangs indefinitely.\\n\\nHave svc_pool_for_cpu() skip pools that currently have no threads,\\nfalling back to the next populated pool.  This trades NUMA locality for\\na guarantee that the work is actually serviced.  sp_nrthreads is only\\nupdated under the service mutex; the lockless read here is a best-effort\\nrouting hint, so annotate it with data_race().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/svc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"9accc25e5af0bac8479f6054e674b2c593c45281\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"6f66d38e2a6c78d48723ea17ad86135ec80ca24b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"edb20e8c03aebacb409968c99d046f509c6c485a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"011479cf9a7657d4a3e7cc42a784ac63df594170\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"9d04d64ad192439835ed9884d767353061c3ed6f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"8f766d2d0b4dabf54f8b35812df2b4f481d13316\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfd241600a3b0db4fe43c859f1460d0a958d924a\",\"lessThan\":\"f6310491c4cdb88af73aa551ec9df1f10a90c709\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/svc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f66d38e2a6c78d48723ea17ad86135ec80ca24b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9accc25e5af0bac8479f6054e674b2c593c45281\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/edb20e8c03aebacb409968c99d046f509c6c485a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:57:27+00:00",
      "cve": "CVE-2026-89549",
      "id": "CVE-2026-89549",
      "initial_release_date": "2026-09-11T19:44:23.928000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: sunrpc connection hang due to threadless pool routing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89549.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.