UBUNTU-CVE-2026-89546: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest() removes the request from bcpalist, drops bcalloccount, marks the request in use, and then asks xprtenqueuebcrequest() to hand it to the callback service. If teardown has already cleared xprt->bcserv, xprtenqueuebcrequest() currently returns without enqueueing or freeing the committed request. The xprtget() taken on entry is leaked as well. If the producer wins the race before bcserv is cleared, it can also enqueue onto svcblist after nfscallbackdown() has stopped the callback threads, leaving the request linked to a svcserv that is about to be freed. Close the producer side before callback threads are stopped. Add xprtsvcshutdownbc() to clear xprt->bcserv under bcpalock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprtenqueuebcrequest() are released through the normal backchannel free path after balancing bcslotcount. Finally, drain any remaining svcblist requests after the callback threads have stopped and before svcdestroy() frees the service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Before stopping callback service threads, close the producer side and call xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock during callback shutdown and callback-start failure. After the callback threads stop, drain remaining sv_cb_list requests before svc_destroy() frees the service. Ensure xprt_enqueue_bc_request() releases requests that lose the NULL transition through the normal backchannel free path after balancing bc_slot_count, and drops the xprt_get() reference taken on entry.