CVE-2026-89549: Linux Kernel sunrpc Race Condition Vulnerability

CVE-2026-89549 Overview

CVE-2026-89549 is a Linux kernel denial-of-service vulnerability in the SUNRPC subsystem. The flaw affects svc_pool_for_cpu(), which routes incoming RPC transports to service thread pools. When a service such as nfsd runs fewer threads than it has pools, for example when configured in pernode or percpu mode on a NUMA host, trailing pools are left with zero threads. Transports assigned to these threadless pools are queued on sp_xprts but never serviced, causing connections to hang indefinitely.

Critical Impact
Remote clients can trigger indefinite NFS connection hangs against a misconfigured server, resulting in loss of availability for file services without authentication.

Affected Products

Linux kernel SUNRPC subsystem
Linux nfsd server in pernode or percpu pool modes
NUMA-enabled hosts running RPC services with thread counts lower than pool counts

Discovery Timeline

2026-09-11 - CVE-2026-89549 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89549

Vulnerability Analysis

The Linux kernel SUNRPC layer distributes worker threads across service pools using the calculation base = nrservs / sv_nrpools inside svc_set_num_threads(). When nrservs is smaller than sv_nrpools, integer division yields zero threads for one or more trailing pools. The routing function svc_pool_for_cpu() still directs incoming transports to a pool based on the CPU handling the request, without checking whether that pool has any active servicing threads.

Once a transport is enqueued on the sp_xprts list of a threadless pool, no thread in another pool will pick it up. Each svc thread exclusively drains its own pool, so the transport waits forever. Remote NFS clients experience indefinite hangs on new connections, degrading availability of the export.

Root Cause

The root cause is missing validation of pool population inside svc_pool_for_cpu(). The routing decision optimizes for NUMA locality but assumes every pool has at least one thread. Configurations that break this assumption, including nfsd running with a thread count below the number of NUMA nodes, expose the defect. This is a resource exhaustion and denial-of-service condition triggered by benign administrator configuration combined with normal client traffic.

Attack Vector

A remote unauthenticated client attempting to mount or communicate with an affected NFS server can land on a threadless pool during transport enqueue. The client-initiated connection is queued but never processed, holding server-side transport state and denying service to that client session. Repeated connection attempts amplify the effect on the CPUs mapped to unpopulated pools.

The fix modifies svc_pool_for_cpu() to skip pools with sp_nrthreads == 0 and fall back to the next populated pool. The lockless read of sp_nrthreads is annotated with data_race() because it is a best-effort routing hint, while authoritative updates continue under the service mutex. See the upstream commits including Kernel Git Commit 011479cf and Kernel Git Commit d79d7b9e for the patch series.

Detection Methods for CVE-2026-89549

Indicators of Compromise

NFS client sessions that connect successfully at the TCP layer but never complete RPC handshakes
Growing sp_xprts queue lengths on specific service pools while other pools remain idle
nfsd thread count configured lower than the number of NUMA nodes on hosts using pernode or percpu pool modes

Detection Strategies

Inspect /proc/fs/nfsd/pool_stats for pools with zero threads and non-zero packets-arrived counters
Correlate kernel version and nfsd thread configuration against affected commit ranges listed in the upstream references
Monitor RPC transport queue depth per pool and alert when queue growth is not matched by service completions

Monitoring Recommendations

Ship NFS server metrics and kernel logs into a centralized analytics platform for long-window trend analysis
Track client-reported RPC timeouts and correlate against server-side pool occupancy metrics
Alert on nfsd thread count changes and on kernel package versions that predate the patch commits

How to Mitigate CVE-2026-89549

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced in the NVD entry across all affected hosts
Audit nfsd thread counts on NUMA hosts and ensure the value is at least equal to sv_nrpools
Switch nfsd pool mode from pernode or percpu to global on hosts where a patch cannot be applied immediately

Patch Information

The fix is available in multiple stable kernel branches. Relevant commits include 011479cf, 6f66d38e, 8f766d2d, 9accc25e, 9d04d64a, d79d7b9e, edb20e8c, and f6310491. Update to a kernel release incorporating these changes and reboot affected systems.

Workarounds

Increase nfsd thread count so it is greater than or equal to sv_nrpools on the host
Configure nfsd to use the global pool mode until the kernel is patched
Restrict NFS export exposure to trusted network segments while patching is scheduled

bash

# Configuration example: ensure nfsd thread count matches or exceeds pool count
# Check current pool mode and stats
cat /sys/module/sunrpc/parameters/pool_mode
cat /proc/fs/nfsd/pool_stats

# Set safe pool mode before starting nfsd
echo global > /sys/module/sunrpc/parameters/pool_mode

# Raise thread count to at least the number of NUMA nodes
NUMA_NODES=$(ls -d /sys/devices/system/node/node* | wc -l)
rpc.nfsd $((NUMA_NODES * 8))