Executive brief
The Linux kernel's Network File System (NFS) callback service uses a backchannel mechanism to handle asynchronous requests from NFS servers. A race condition during service shutdown can leave pending requests linked to freed memory, potentially leading to a system crash or denial of service affecting systems using NFS with NFSv4.1 callback functionality enabled.
Technical details
This vulnerability is a use-after-free race condition in the SUNRPC backchannel subsystem (net/sunrpc/backchannel_rqst.c). The root cause is improper synchronization during NFS callback service teardown: if a backchannel request completes while the callback service is being destroyed, the request may be enqueued onto a service structure (sv_cb_list) after callback threads have stopped but before the service is freed, or xprt_get() references may be leaked if bc_serv is already NULL. The vulnerability requires NFS callback service teardown to occur concurrently with backchannel request completion. The fix adds xprt_svc_shutdown_bc() to safely clear the backchannel service pointer under proper locking before stopping callback threads, and drains remaining requests after threads stop but before the service is destroyed. Patches have been merged into the Linux kernel stable trees.
Affected products
- Linux Linux kernel 2.6.11 through 6.19, 7.0+
Timeline
- 2026-09-11: disclosed: CVE-2026-89546 published on NVD
- 2026-05-28: patched: Upstream fix commit 3674f780f47d2906b5a0f7199b66973067bdfeca by Chris Mason
- 2026-09-07: patched: Backported to stable kernel branches (commit 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8)