CVE-2026-89549 sunrpc: route to a populated pool in svc_pool_for_cpu()
An attacker can cause indefinite connection hangs in NFS services by exploiting thread pool routing flaws when thread counts are lower than NUMA nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89549?
CVE-2026-89549 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: route to a populated pool in svc_pool_for_cpu()
svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all.
svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely.
Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race().
Which versions are affected by CVE-2026-89549?
How do I fix CVE-2026-89549?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89549 being exploited?
There is no known exploitation of CVE-2026-89549 in the wild and no public exploit code.
Sources
Also known as AZL-100421, BELL-CVE-2026-89549, DEBIAN-CVE-2026-89549, GHSA-j6w6-qx29-46gg, UBUNTU-CVE-2026-89549.