CVE-2026-89546

A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) Network File System (NFS) callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource leak. This issue could also result in a use-after-free vulnerability, where the system attempts to access memory that has already been deallocated. An attacker could potentially exploit this vulnerability to cause a denial of service, making the affected system unstable or unresponsive.

A race in the SUNRPC NFS backchannel teardown path can allow a backchannel receive to complete while the callback service is being shut down. The request can be committed and then either leaked when xprt bc_serv is already NULL, or queued on sv_cb_list after callback threads have stopped while the svc_serv object is close to destruction. For the CVSS the PR:N is used because a malicious or compromised NFS peer can send backchannel traffic over an existing transport without local privileges on the victim. The issue is network reachable in deployments where the victim NFS client is connected to an attacker controlled or compromised NFS server, but practical exploitation depends on racing callback service teardown and is not an Internet wide exposure in typical environments. Impact is at least denial of service through leaked requests, reference leaks, stalled teardown, or kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.