Vulnerability-Lookup

GHSA-GGX6-MW65-HCJR

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: close backchannel before destroying callback service

A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service.

If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed.

Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89546"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:37Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: close backchannel before destroying callback service\n\nA backchannel receive can complete a request while the NFS callback\nservice is being torn down.  xprt_complete_bc_request() removes the\nrequest from bc_pa_list, drops bc_alloc_count, marks the request in use,\nand then asks xprt_enqueue_bc_request() to hand it to the callback\nservice.\n\nIf teardown has already cleared xprt-\u003ebc_serv, xprt_enqueue_bc_request()\ncurrently returns without enqueueing or freeing the committed request.\nThe xprt_get() taken on entry is leaked as well.  If the producer wins\nthe race before bc_serv is cleared, it can also enqueue onto sv_cb_list\nafter nfs_callback_down() has stopped the callback threads, leaving the\nrequest linked to a svc_serv that is about to be freed.\n\nClose the producer side before callback threads are stopped.  Add\nxprt_svc_shutdown_bc() to clear xprt-\u003ebc_serv under bc_pa_lock, and call\nit on callback shutdown and callback-start failure before stopping the\nservice threads.  Requests that lose the NULL transition in\nxprt_enqueue_bc_request() are released through the normal backchannel\nfree path after balancing bc_slot_count.  Finally, drain any remaining\nsv_cb_list requests after the callback threads have stopped and before\nsvc_destroy() frees the service.",
  "id": "GHSA-ggx6-mw65-hcjr",
  "modified": "2026-09-13T09:32:17Z",
  "published": "2026-09-11T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89546"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3674f780f47d2906b5a0f7199b66973067bdfeca"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6debde9e3e6ae21dcca75837b4247b13ca4ea2b8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-89546 (GCVE-0-2026-89546)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48

Title

SUNRPC: close backchannel before destroying callback service

Summary

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/6debde9e3e6ae21dc…
https://git.kernel.org/stable/c/3674f780f47d2906b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 441244d4273a8037b265fd254dfdaca5fa736ee2 , < 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8 (git) Affected: 441244d4273a8037b265fd254dfdaca5fa736ee2 , < 3674f780f47d2906b5a0f7199b66973067bdfeca (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback.c",
            "include/linux/sunrpc/bc_xprt.h",
            "net/sunrpc/backchannel_rqst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6debde9e3e6ae21dcca75837b4247b13ca4ea2b8",
              "status": "affected",
              "version": "441244d4273a8037b265fd254dfdaca5fa736ee2",
              "versionType": "git"
            },
            {
              "lessThan": "3674f780f47d2906b5a0f7199b66973067bdfeca",
              "status": "affected",
              "version": "441244d4273a8037b265fd254dfdaca5fa736ee2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback.c",
            "include/linux/sunrpc/bc_xprt.h",
            "net/sunrpc/backchannel_rqst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: close backchannel before destroying callback service\n\nA backchannel receive can complete a request while the NFS callback\nservice is being torn down.  xprt_complete_bc_request() removes the\nrequest from bc_pa_list, drops bc_alloc_count, marks the request in use,\nand then asks xprt_enqueue_bc_request() to hand it to the callback\nservice.\n\nIf teardown has already cleared xprt-\u003ebc_serv, xprt_enqueue_bc_request()\ncurrently returns without enqueueing or freeing the committed request.\nThe xprt_get() taken on entry is leaked as well.  If the producer wins\nthe race before bc_serv is cleared, it can also enqueue onto sv_cb_list\nafter nfs_callback_down() has stopped the callback threads, leaving the\nrequest linked to a svc_serv that is about to be freed.\n\nClose the producer side before callback threads are stopped.  Add\nxprt_svc_shutdown_bc() to clear xprt-\u003ebc_serv under bc_pa_lock, and call\nit on callback shutdown and callback-start failure before stopping the\nservice threads.  Requests that lose the NULL transition in\nxprt_enqueue_bc_request() are released through the normal backchannel\nfree path after balancing bc_slot_count.  Finally, drain any remaining\nsv_cb_list requests after the callback threads have stopped and before\nsvc_destroy() frees the service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The producer is xs_read_stream_call()/rpcrdma_bc_receive_call() handling RPC_CALL messages on the established NFSv4.1+ client TCP or RPC/RDMA transport; a malicious NFS server sends backchannel frames on that connection and reaches the bug without local access.\nAC:L - The attacker controls both sides of the race: they emit backchannel RPC_CALLs on the still-live xprt and force callback teardown via failed session setup, autofs expiry, or unmount, leaving rpc_rqst objects on sv_cb_list when svc_destroy() frees svc_serv.\nPR:N - A remote NFS peer needs no account or capability on the victim; backchannel RPC_CALLs are accepted on the connected NFSv4.1+ transport once a mount or mount attempt exists, with no local privileges at exploit time.\nUI:N - Boot-time, autofs, and Kubernetes NFSv4.1+ mounts are common; after that session exists the attacker drives backchannel traffic and callback teardown without further interactive victim action such as a manual mount.\nS:U - The use-after-free corrupts the in-kernel nfs_callback svc_serv and rpc_rqst objects on the client host and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - A raced enqueue leaves an in-use rpc_rqst linked into a freed svc_serv (sv_cb_list/sv_pools), and unlocked bc_serv readers can follow that dangling pointer, yielding a kernel-heap use-after-free read primitive.\nI:H - Use-after-free of svc_serv with queued rpc_rqst and svc_pool_wake_idle_thread on dying callback pools enables heap reuse of RPC service control structures, a standard kernel write and control-flow hijack primitive.\nA:H - svc_destroy() of a callback service that still has live backchannel requests, plus dereference of xprt-\u003ebc_serv after free, causes kernel oops or panic; the leak path also orphans rpc_rqst objects and xprt references."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:37.920Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6debde9e3e6ae21dcca75837b4247b13ca4ea2b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3674f780f47d2906b5a0f7199b66973067bdfeca"
        }
      ],
      "title": "SUNRPC: close backchannel before destroying callback service",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89546",
    "datePublished": "2026-09-11T19:44:21.898Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-10-19T08:48:37.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted