CVE-2026-89546: Linux Kernel SUNRPC Race Condition Vulnerability

CVE-2026-89546 Overview

CVE-2026-89546 is a use-after-free race condition in the Linux kernel SUNRPC subsystem. The flaw resides in the NFS callback backchannel teardown path, where a backchannel receive can complete a request while the callback service is being destroyed. Under specific race conditions, the kernel enqueues a request onto sv_cb_list after nfs_callback_down() has stopped callback threads, leaving the request linked to a svc_serv structure that is about to be freed. The vulnerability is network-reachable and impacts confidentiality, integrity, and availability.

Critical Impact
A remote attacker capable of triggering NFS callback traffic can race the callback service teardown to induce use-after-free conditions in kernel memory, enabling potential denial of service or memory corruption in the SUNRPC subsystem.

Affected Products

Linux kernel SUNRPC subsystem (upstream)
Linux kernel NFS callback service
Distributions shipping kernels prior to commits 3674f78 and 6debde9

Discovery Timeline

2026-09-11 - CVE-2026-89546 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89546

Vulnerability Analysis

The vulnerability exists in the Linux kernel SUNRPC backchannel processing logic. When an NFS backchannel receive completes, xprt_complete_bc_request() removes the request from bc_pa_list, decrements bc_alloc_count, marks the request in use, and passes it to xprt_enqueue_bc_request() for delivery to the callback service.

During concurrent teardown of the NFS callback service, xprt->bc_serv can be cleared. If teardown wins the race, xprt_enqueue_bc_request() returns without enqueueing or freeing the committed request. The xprt_get() reference taken on entry leaks, and the request is orphaned.

If the producer wins the race before bc_serv is cleared, it can enqueue onto sv_cb_list after nfs_callback_down() has already stopped the callback threads. The request then remains linked to a svc_serv structure that is about to be freed by svc_destroy(), creating a use-after-free condition exploitable across a network attack surface.

Root Cause

The root cause is a race condition between the backchannel producer path and the callback service teardown path. The producer side was not closed before the callback threads were stopped, allowing requests to be committed into a service that is being destroyed.

Attack Vector

The attack vector is network-based. An adversary able to influence NFS backchannel traffic against a vulnerable kernel can attempt to trigger the race window during callback service shutdown or restart. Successful exploitation manifests as memory corruption in kernel space with no user interaction required.

No public proof-of-concept exploit code is available. See the upstream fixes at Kernel Git Commit 3674f78 and Kernel Git Commit 6debde9 for the technical fix details.

Detection Methods for CVE-2026-89546

Indicators of Compromise

Kernel oops or panic messages referencing xprt_enqueue_bc_request, sv_cb_list, or svc_destroy in dmesg or journalctl -k output.
Unexpected NFS client callback service restarts correlated with backchannel activity.
KASAN reports indicating use-after-free in the SUNRPC subsystem on kernels with debugging enabled.

Detection Strategies

Inventory running kernel versions across Linux fleet and cross-reference with the fixed commits 3674f78 and 6debde9.
Monitor NFS client and server logs for callback service failures coinciding with nfs_callback_down() invocations.
Correlate kernel crash telemetry with NFS mount activity to identify hosts exhibiting the race condition.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on SUNRPC-related stack traces.
Track NFS callback thread lifecycle events on hosts mounting NFSv4.1 or later exports.
Baseline expected NFS backchannel volume and alert on anomalous callback request patterns.

How to Mitigate CVE-2026-89546

Immediate Actions Required

Apply vendor-supplied kernel updates that incorporate upstream commits 3674f78 and 6debde9 as soon as they become available for your distribution.
Prioritize patching NFS client hosts that mount untrusted or internet-adjacent NFS exports.
Reboot patched systems to load the fixed kernel; live-patch equivalents should be validated with the distribution vendor.

Patch Information

The upstream fix introduces xprt_svc_shutdown_bc(), which clears xprt->bc_serv under bc_pa_lock and is invoked on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Remaining sv_cb_list requests are drained after the callback threads stop and before svc_destroy() frees the service. Reference commits: Kernel Git Commit 3674f78 and Kernel Git Commit 6debde9.

Workarounds

Restrict NFS traffic to trusted network segments using host firewalls and network ACLs until kernels are patched.
Avoid unnecessary NFS callback service restarts on production hosts to reduce race window exposure.
Where feasible, disable NFSv4.1+ callback-dependent features on systems that cannot be patched immediately.

bash

# Verify running kernel version and check for the fix
uname -r

# Query package manager for kernel updates (RHEL/CentOS/Fedora)
sudo dnf check-update kernel

# Query package manager for kernel updates (Debian/Ubuntu)
sudo apt update && sudo apt list --upgradable | grep linux-image

# Restrict NFS traffic at the host firewall (example: nftables)
sudo nft add rule inet filter input tcp dport {111, 2049} ip saddr != 10.0.0.0/8 drop