CVE-2026-89546

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: close backchannel before destroying callback service

A backchannel receive can complete a request while the NFS callback

service is being torn down. xprt_complete_bc_request() removes the

request from bc_pa_list, drops bc_alloc_count, marks the request in use,

and then asks xprt_enqueue_bc_request() to hand it to the callback

service.

If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request()

currently returns without enqueueing or freeing the committed request.

The xprt_get() taken on entry is leaked as well. If the producer wins

the race before bc_serv is cleared, it can also enqueue onto sv_cb_list

after nfs_callback_down() has stopped the callback threads, leaving the

request linked to a svc_serv that is about to be freed.

Close the producer side before callback threads are stopped. Add

xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call

it on callback shutdown and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References