CVE-2026-89547

A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently accessed, can silently corrupt data in the current CPU's per-CPU area. This corruption could lead to system instability or a denial of service.

SUNRPC service creation ignored percpu_counter_init failures for per pool statistics counters. If a percpu allocation fails during RPC server startup, the service can become live with a NULL percpu counter pointer and uninitialized counter internals. Later hot path counter updates may treat the NULL percpu pointer as offset zero in the current CPU percpu area, which can silently corrupt unrelated percpu memory instead of causing a simple NULL pointer fault. For the CVSS the PR:H is used because reliable creation of the broken service requires local administrator control over RPC server startup together with memory pressure or fault injection. The issue is not directly network reachable because a remote peer cannot create the bad service state on its own, although later RPC traffic may exercise the corrupted counters after the local failure condition exists. Impact is at least local denial of service and may include confidentiality or integrity impact due to percpu memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.