{"id":"CVE-2026-89547","revision":"ba78c830329c4955967f6fd1d2002ecf","records":[{"revision":"ba78c830329c4955967f6fd1d2002ecf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89547","aliases":[],"title":"SUNRPC: Check svc pool percpu counter allocation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Check svc pool percpu counter allocation\n\n__svc_create() initializes three per-pool percpu_counter stats and\nignores every return value. On SMP, percpu_counter_init() fails when\n__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed\ncounter with fbc->counters == NULL and its embedded raw_spinlock_t,\nlist_head, and count never initialized. __svc_create() returns the\nhalf-constructed svc_serv to nfsd, lockd, or the NFS callback service\nanyway.\n\nOnce that service is live, the hot-path increments in\nsvc_xprt_enqueue(), svc_handle_xprt(), and\nsvc_pool_wake_idle_thread() reach a counter whose backing pointer is\nNULL. The pointer is a per-cpu offset, so the access does not fault:\nit resolves to offset zero of the current CPU's per-cpu area and\nsilently corrupts whatever variable lives there. A\n/proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and\nreturns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on\nthe never-initialized lock.\n\nCreating the broken service requires a percpu allocation failure during\nRPC server startup, so it is reachable only by a local administrator\nunder memory pressure or fault injection; a remote peer cannot induce\nthe bad state on its own.\n\nCheck each percpu_counter_init() return value in __svc_create() and\nfail when an allocation fails, unwinding the counters already set up\nin the current pool and in every pool initialized before it. A\ndiscrete percpu_counter_destroy() per counter at teardown frees each\nper-cpu allocation exactly once.","state":0,"publishedAt":"2026-09-11T19:44:22.644+00:00","modifiedAt":"2026-10-19T08:48:38.898+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sunrpc/svc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ccf08bed6e7a80519569456edd2ea21b7b1701c6\",\n                            \"lessThan\": \"57ac7d899409b0a9b768cf417e3bb86bcca3d4c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf08bed6e7a80519569456edd2ea21b7b1701c6\",\n                            \"lessThan\": \"3a2b7649de76376a69f1d3ed2a539fb15907cd4d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf08bed6e7a80519569456edd2ea21b7b1701c6\",\n                            \"lessThan\": \"bd1ef2cfb44d72b7aa6943e87b206eb0e30fbd0c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf08bed6e7a80519569456edd2ea21b7b1701c6\",\n                            \"lessThan\": \"b541a15046976e481618726cc23db0fb22d576db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccf08bed6e7a80519569456edd2ea21b7b1701c6\",\n                            \"lessThan\": \"43e11e164704dde975c9edb370de1a06bec67270\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sunrpc/svc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/57ac7d899409b0a9b768cf417e3bb86bcca3d4c6","https://git.kernel.org/stable/c/3a2b7649de76376a69f1d3ed2a539fb15907cd4d","https://git.kernel.org/stable/c/bd1ef2cfb44d72b7aa6943e87b206eb0e30fbd0c","https://git.kernel.org/stable/c/b541a15046976e481618726cc23db0fb22d576db","https://git.kernel.org/stable/c/43e11e164704dde975c9edb370de1a06bec67270"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89547","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89547","identifiers":["CVE-2026-89547"]},"retained":false,"historicalAffected":[]}],"coverage":[]}