CVE-2026-89549

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: route to a populated pool in svc_pool_for_cpu()

svc_set_num_threads() spreads the requested threads evenly across the

service's pools (base = nrservs / sv_nrpools). When a service runs

fewer threads than it has pools -- e.g. an nfsd configured with fewer

threads than the host has NUMA nodes while running in "pernode" or

"percpu" mode -- the trailing pools are left with no threads at all.

svc_xprt_enqueue() selects a pool from the CPU servicing the transport,

queues the transport on that pool's sp_xprts, and only wakes a thread

from the same pool. Each thread services exclusively its own pool, so a

transport that lands on a threadless pool is enqueued on sp_xprts and

never picked up: the connection hangs indefinitely.

Have svc_pool_for_cpu() skip pools that currently have no threads,

falling back to the next populated pool. This trades NUMA locality for

a guarantee that the work is actually serviced. sp_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References