CVE-2026-89546: SUNRPC: close backchannel before destroying callback service
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: close backchannel before destroying callback service
A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest() removes the request from bcpalist, drops bcalloccount, marks the request in use, and then asks xprtenqueuebcrequest() to hand it to the callback service.
If teardown has already cleared xprt->bcserv, xprtenqueuebcrequest() currently returns without enqueueing or freeing the committed request. The xprtget() taken on entry is leaked as well. If the producer wins the race before bcserv is cleared, it can also enqueue onto svcblist after nfscallbackdown() has stopped the callback threads, leaving the request linked to a svcserv that is about to be freed.
Close the producer side before callback threads are stopped. Add xprtsvcshutdownbc() to clear xprt->bcserv under bcpalock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprtenqueuebcrequest() are released through the normal backchannel free path after balancing bcslotcount. Finally, drain any remaining svcblist requests after the callback threads have stopped and before svcdestroy() frees the service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/patch the Linux kernel so that the SUNRPC backchannel is closed before the callback service is destroyed, preventing a race where requests can complete while NFS callback threads are still being stopped.
Linux kernel SUNRPC Close backchannel before destroying callback service = Apply the resolved teardown ordering (close backchannel before destroying callback service) - Compensating control
When applying the mitigation described for SUNRPC, ensure producer-side teardown synchronizes correctly: close the producer side before callback threads are stopped, and drain any remaining backchannel requests after shutdown to avoid leaked/lefter requests on teardown races.
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Linux systems using NFS callback services with SUNRPC backchannel activity, particularly where callback shutdown or callback-start failure can occur while backchannel receives are completing. The issue is a race during callback-service teardown.
Are fixes referenced for this issue?
Yes. The provided references include stable kernel commits 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8 and 3674f780f47d2906b5a0f7199b66973067bdfeca.