CVE-2026-89549

CVE-2026-89549 is a Denial of Service vulnerability in the Linux kernel's sunrpc subsystem (used by nfsd). When a service runs fewer threads than available pools—for example, nfsd configured with fewer threads than the host's NUMA nodes in pernode or percpu mode—svc_xprt_enqueue() can route a tra...

CVE-2026-89548

CVE-2026-89548 is a use-after-free in the Linux kernel's SUNRPC component. The function sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed work when cache_list is empty. During per-netns teardown, cache_list is never empty (init_net's caches remain), so the cancel never f...

CVE-2026-89547 SUNRPC: Check svc pool percpu counter allocation

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547 SUNRPC: Check svc pool percpu counter allocation

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

EUVD-2026-76458

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547

CVE-2026-89547 affects the Linux kernel's SUNRPC component. The function __svc_create() initializes three per-pool percpu_counter statistics but ignores all return values. On SMP systems, if percpu_counter_init() fails due to a per-cpu allocation failure (e.g., under memory pressure or fault inje...

CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

EUVD-2026-76456

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

EUVD-2026-76457

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89546

CVE-2026-89546 affects the Linux kernel's SUNRPC subsystem, specifically the NFS callback service. A race condition during service teardown can cause two distinct issues: a resource leak when xprt_enqueue_bc_request() returns without enqueuing or freeing a committed request (and its associated xp...

CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89545

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89545

CVE-2026-89545 is a use-after-free in the Linux kernel's sunrpc subsystem. The function svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), while the parent rqstp struct is deferred via kfree_rcu(). After svc_exit_thread() removes the thread from the RCU list,...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...