CVE-2026-89546: SUNRPC: close backchannel before destroying callback service
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: close backchannel before destroying callback service
A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest() removes the request from bcpalist, drops bcalloccount, marks the request in use, and then asks xprtenqueuebcrequest() to hand it to the callback service.
If teardown has already cleared xprt->bcserv, xprtenqueuebcrequest() currently returns without enqueueing or freeing the committed request. The xprtget() taken on entry is leaked as well. If the producer wins the race before bcserv is cleared, it can also enqueue onto svcblist after nfscallbackdown() has stopped the callback threads, leaving the request linked to a svcserv that is about to be freed.
Close the producer side before callback threads are stopped. Add xprtsvcshutdownbc() to clear xprt->bcserv under bcpalock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprtenqueuebcrequest() are released through the normal backchannel free path after balancing bcslotcount. Finally, drain any remaining svcblist requests after the callback threads have stopped and before svcdestroy() frees the service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the SUNRPC backchannel teardown logic to add xprt_svc_shutdown_bc(), clear xprt->bc_serv under bc_pa_lock, and invoke it during callback shutdown and callback-start failure before stopping service threads. Close the producer side before stopping callback threads, then drain remaining sv_cb_list requests after the callback threads stop and before svc_destroy() frees the service.
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Linux systems using NFS callback services with SUNRPC backchannel activity, particularly where callback shutdown or callback-start failure can occur while backchannel receives are completing. The issue is a race during callback-service teardown.
Are fixes referenced for this issue?
Yes. The provided references include stable kernel commits 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8 and 3674f780f47d2906b5a0f7199b66973067bdfeca.