CVE-2026-89547: Linux Kernel SUNRPC Privilege Escalation

CVE-2026-89547 is a privilege escalation flaw in the Linux kernel SUNRPC component affecting memory allocation checks. The vulnerability allows local administrators to corrupt system memory under pressure conditions. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-89547 Overview

CVE-2026-89547 is a Linux kernel vulnerability in the SUNRPC subsystem. The __svc_create() function initializes three per-pool percpu_counter statistics without checking the return value of percpu_counter_init(). On SMP systems under memory pressure, __alloc_percpu_gfp() can fail, leaving fbc->counters set to NULL while the RPC service continues to start. The half-constructed svc_serv is passed to nfsd, lockd, or the NFS callback service, resulting in silent per-CPU memory corruption and uninitialized raw_spinlock_t access on hot paths [CWE-252, CWE-908].

Critical Impact
Local administrators triggering percpu allocation failure during RPC server startup can silently corrupt kernel per-CPU memory and cause spinlock splats under lockdep.

Affected Products

Linux kernel SUNRPC subsystem (multiple stable branches)
Kernel NFS server (nfsd)
Kernel lock manager (lockd) and NFS callback service

Discovery Timeline

2026-09-11 - CVE-2026-89547 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89547

Vulnerability Analysis

The defect resides in __svc_create() within the kernel SUNRPC layer. The function calls percpu_counter_init() three times per service pool to establish statistics counters but discards every return value. When __alloc_percpu_gfp() cannot fulfill the request on SMP builds, the counter's backing storage remains NULL and its embedded raw_spinlock_t, list_head, and count fields never get initialized.

Despite the failure, __svc_create() returns the partially constructed svc_serv to the caller. Downstream consumers such as nfsd, lockd, and the NFS callback service begin operating on the broken structure. Hot-path callers including svc_xprt_enqueue(), svc_handle_xprt(), and svc_pool_wake_idle_thread() then increment counters through the NULL pointer.

Because the pointer is a per-CPU offset, the dereference does not fault. It instead resolves to offset zero of the current CPU's per-CPU area and silently overwrites whatever variable occupies that slot. Reads of /proc/fs/nfsd/pool_stats traverse the same NULL per-CPU storage and return garbage output.

Root Cause

The root cause is an unchecked return value from percpu_counter_init(). The initialization path assumes success and never validates the allocation. Kernels built with CONFIG_DEBUG_SPINLOCK or lockdep additionally splat because the embedded raw_spinlock_t is used without being initialized.

Attack Vector

Exploitation requires triggering a percpu allocation failure during RPC server startup. This is reachable only by a local administrator through induced memory pressure or fault injection. A remote peer cannot force the bad state directly. Post-corruption, the service continues running while silently damaging kernel per-CPU data, which can propagate into unrelated subsystems and destabilize the host.

Refer to the Kernel Commit 3a2b764 and Kernel Commit 43e11e16 for the corrective patch series.

Detection Methods for CVE-2026-89547

Indicators of Compromise

Kernel log entries containing lockdep or CONFIG_DEBUG_SPINLOCK splats referencing SUNRPC service pool counters.
Garbled or nonsensical output when reading /proc/fs/nfsd/pool_stats.
dmesg allocation failure warnings from __alloc_percpu_gfp() occurring near nfsd, lockd, or NFS callback service startup.

Detection Strategies

Monitor kernel ring buffers for percpu allocation failures coinciding with RPC service initialization.
Correlate NFS server start events with subsequent unexplained per-CPU variable corruption or kernel crashes.
Audit installed kernel versions against the fixed commits published on git.kernel.org stable trees.

Monitoring Recommendations

Ingest kernel logs and NFS server telemetry into a centralized SIEM for pattern analysis.
Alert on repeated NFS or lockd service restarts following memory pressure events.
Track host memory saturation metrics on systems exporting NFS shares to detect conditions that could induce the failure.

How to Mitigate CVE-2026-89547

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record and reboot affected hosts.
Restrict administrative access on systems running nfsd, lockd, or the NFS callback service to reduce local attack surface.
Avoid enabling fault injection frameworks on production RPC servers.

Patch Information

The fix validates each percpu_counter_init() return value in __svc_create() and unwinds counters already initialized in the current and prior pools when allocation fails. A discrete percpu_counter_destroy() per counter at teardown ensures each per-CPU allocation is freed exactly once. Patches are available in Kernel Commit 57ac7d89, Kernel Commit b541a150, and Kernel Commit bd1ef2cf.

Workarounds

Maintain sufficient free memory on RPC-serving hosts to prevent percpu allocation failures during service startup.
Disable NFS server, lockd, or NFS callback services on hosts that do not require them until patched kernels are deployed.
Avoid restarting SUNRPC-dependent services during periods of severe memory contention.