FKIE_CVE-2026-89549

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-10-19 09:17
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely. Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race().
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6f66d38e2a6c78d48723ea17ad86135ec80ca24b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9accc25e5af0bac8479f6054e674b2c593c45281
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/edb20e8c03aebacb409968c99d046f509c6c485a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9accc25e5af0bac8479f6054e674b2c593c45281",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "6f66d38e2a6c78d48723ea17ad86135ec80ca24b",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "edb20e8c03aebacb409968c99d046f509c6c485a",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "011479cf9a7657d4a3e7cc42a784ac63df594170",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "9d04d64ad192439835ed9884d767353061c3ed6f",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "8f766d2d0b4dabf54f8b35812df2b4f481d13316",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            },
            {
              "lessThan": "f6310491c4cdb88af73aa551ec9df1f10a90c709",
              "status": "affected",
              "version": "bfd241600a3b0db4fe43c859f1460d0a958d924a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: route to a populated pool in svc_pool_for_cpu()\n\nsvc_set_num_threads() spreads the requested threads evenly across the\nservice\u0027s pools (base = nrservs / sv_nrpools).  When a service runs\nfewer threads than it has pools -- e.g. an nfsd configured with fewer\nthreads than the host has NUMA nodes while running in \"pernode\" or\n\"percpu\" mode -- the trailing pools are left with no threads at all.\n\nsvc_xprt_enqueue() selects a pool from the CPU servicing the transport,\nqueues the transport on that pool\u0027s sp_xprts, and only wakes a thread\nfrom the same pool.  Each thread services exclusively its own pool, so a\ntransport that lands on a threadless pool is enqueued on sp_xprts and\nnever picked up: the connection hangs indefinitely.\n\nHave svc_pool_for_cpu() skip pools that currently have no threads,\nfalling back to the next populated pool.  This trades NUMA locality for\na guarantee that the work is actually serviced.  sp_nrthreads is only\nupdated under the service mutex; the lockless read here is a best-effort\nrouting hint, so annotate it with data_race()."
    }
  ],
  "id": "CVE-2026-89549",
  "lastModified": "2026-10-19T09:17:50.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-89549",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T19:23:44.786723Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-11T20:19:38.373",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6f66d38e2a6c78d48723ea17ad86135ec80ca24b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9accc25e5af0bac8479f6054e674b2c593c45281"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/edb20e8c03aebacb409968c99d046f509c6c485a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.