CVE-2026-89547

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Check svc pool percpu counter allocation

__svc_create() initializes three per-pool percpu_counter stats and

ignores every return value. On SMP, percpu_counter_init() fails when

__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed

counter with fbc->counters == NULL and its embedded raw_spinlock_t,

list_head, and count never initialized. __svc_create() returns the

half-constructed svc_serv to nfsd, lockd, or the NFS callback service

anyway.

Once that service is live, the hot-path increments in

svc_xprt_enqueue(), svc_handle_xprt(), and

svc_pool_wake_idle_thread() reach a counter whose backing pointer is

NULL. The pointer is a per-cpu offset, so the access does not fault:

it resolves to offset zero of the current CPU's per-cpu area and

silently corrupts whatever variable lives there. A

/proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and

returns garbage, and on CONFIG_DEBUG_SP

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References