CVE-2026-89549 sunrpc: route to a populated pool in svc_pool_for_cpu()

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547

CVE-2026-89547 affects the Linux kernel's SUNRPC component. The function __svc_create() initializes three per-pool percpu_counter statistics but ignores all return values. On SMP systems, if percpu_counter_init() fails due to a per-cpu allocation failure (e.g., under memory pressure or fault inje...

CVE-2026-89547 SUNRPC: Check svc pool percpu counter allocation

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547 SUNRPC: Check svc pool percpu counter allocation

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

EUVD-2026-76458

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

EUVD-2026-76457

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89546

CVE-2026-89546 affects the Linux kernel's SUNRPC subsystem, specifically the NFS callback service. A race condition during service teardown can cause two distinct issues: a resource leak when xprt_enqueue_bc_request() returns without enqueuing or freeing a committed request (and its associated xp...

EUVD-2026-76456

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89545

CVE-2026-89545 is a use-after-free in the Linux kernel's sunrpc subsystem. The function svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), while the parent rqstp struct is deferred via kfree_rcu(). After svc_exit_thread() removes the thread from the RCU list,...

CVE-2026-89545

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89544

CVE-2026-89544 affects the Linux kernel's SUNRPC subsystem, specifically the gssx_dec_option_array() XDR option-array decoder. Four coupled defects in its error paths introduce a NULL dereference (when oa->count is set before oa->data allocation fails), a refcount leak on cr_group_info (rel...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

EUVD-2026-76455

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...