CVE-2026-89549

A flaw was found in the sunrpc component of the Linux kernel. When the nfsd service runs with fewer threads than available pools, a transport can be routed to a pool with no active threads. This prevents the connection from being processed, causing it to hang indefinitely. This can lead to a Denial of Service (DoS) condition for affected services.

A flaw in the sunrpc subsystem of the Linux kernel, rated MODERATE severity by Red Hat Product Security, affects Red Hat Enterprise Linux (kernel and kernel-rt), the RHCOS 8 and RHCOS 9 kernels shipped with OpenShift Container Platform 4 and 5, and Red Hat In-Vehicle OS. When the nfsd service runs with fewer threads than it has pools -- for example, an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- svc_xprt_enqueue() selects the pool from the CPU servicing the transport and queues the transport on that pool's sp_xprts, waking only a thread from the same pool. If the selected pool has no threads, the transport is enqueued but never picked up, because each nfsd thread services exclusively its own pool, and the connection hangs indefinitely. The result is a denial of service limited to the availability of the affected NFS service; there is no impact on confidentiality or integrity. The RHEL 6 ELS kernel is out of support scope (OOSS).

Red Hat rates this flaw MODERATE (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org score of 7.5, because triggering the hang requires a specific local nfsd configuration -- fewer threads than pools in a multi-pool mode such as "pernode" or "percpu" -- rather than a straightforward remotely exploitable condition. Fixes for the affected Red Hat products are currently deferred because the flaw is MODERATE severity with a CVSS score below 7.0, for which Red Hat Product Security does not prioritize fixes in these products. The residual risk is a denial of service against nfsd on hosts configured in the vulnerable state: connections routed to a threadless pool hang indefinitely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable condition exists only when nfsd runs with fewer threads than it has pools. Ensure nfsd is configured with at least one thread per pool -- for example, at least as many nfsd threads as the host has NUMA nodes when running in "pernode" mode, or CPUs when running in "percpu" mode -- so that no pool is left without threads. Alternatively, avoiding the multi-pool "pernode"/"percpu" nfsd modes prevents the vulnerable configuration. A fix for the affected Red Hat products is currently deferred; once a fixed kernel becomes available, upgrading to it will remove the vulnerability.