Executive brief
A flaw in the Linux kernel's sunrpc module causes NFS server connections to hang indefinitely when thread pools are unevenly distributed across NUMA nodes or CPUs. When an NFS service is configured with fewer worker threads than available processor pools, some pools receive no threads; incoming client connections routed to these empty pools never receive service, resulting in hung connections and unavailable NFS service.
Technical details
The vulnerability exists in the svc_pool_for_cpu() function in net/sunrpc/svc.c. When svc_set_num_threads() distributes worker threads evenly across service pools, trailing pools can be left with zero threads if thread count is less than pool count (common in NUMA-aware or per-CPU configurations). svc_xprt_enqueue() selects a pool based on the CPU handling the transport and queues it exclusively on that pool. Since each thread services only its own pool, transports landing on threadless pools are enqueued but never picked up, hanging indefinitely. The fix adds logic to skip pools with zero threads (sp_nrthreads == 0) and fall back to the next populated pool, sacrificing NUMA locality for service availability. The patch is included in stable Linux kernels and upstream.
Affected products
- Linux Linux kernel 2.6.11 through 6.18 (affected versions vary by stable series)
Timeline
- 2026-09-11: disclosed: CVE-2026-89549 published
- 2026-09-07: patched: Fix committed to stable trees by Greg Kroah-Hartman