CVE-2026-89546
massRace condition use-after-free in Linux kernel SUNRPC NFS backchannel teardown
The Linux kernel's SUNRPC layer mishandles a race between an incoming NFS backchannel (callback) request and teardown of the NFS callback service on an NFS client. If a malicious or compromised NFS server delivers a callback at the moment the client unmounts and nfs_callback_down() destroys the service, the request can be left committed but never enqueued or freed (leaking a transport reference) or can be enqueued onto an svc_serv that is about to be freed, producing a use-after-free in kernel memory. Successful exploitation of that memory corruption could crash the kernel or potentially lead to code execution with kernel privileges, consistent with the critical 9.8 CVSS score assigned (network attack vector, no privileges or user interaction required). Any Linux system acting as an NFSv4 client — particularly NFSv4.1+ mounts that use sessions and the shared-connection backchannel — is potentially affected, with the attacker positioned on the server side of the mount. No public proof of concept exists and no exploitation in the wild has been reported; the flaw was found and fixed in kernel development.
What to do: Apply your distribution's kernel update containing the fix as soon as it is released and reboot into the patched kernel. In the interim, mount NFSv4 filesystems only from trusted, hardened servers and restrict NFS client mounts to approved hosts, since exploitation requires a malicious or compromised NFS server sending callbacks during client unmount. Monitor NFS client systems for kernel oops/BUG traces in the sunrpc/xprt backchannel path and unexplained kernel memory growth.
| Linux kernel (SUNRPC backchannel / NFS callback service) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.