---
id: CVE-2026-89546
title: 'SUNRPC: close backchannel before destroying callback service'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  SUNRPC: close backchannel before destroying callback service

  A backchannel receive can complete a request while the NFS callback
  service is being torn down.  xprt_comp…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-911
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 441244d4273a8037b265fd254dfdaca5fa736ee2 <
    6debde9e3e6ae21dcca75837b4247b13ca4ea2b8
  - >-
    Linux >= 441244d4273a8037b265fd254dfdaca5fa736ee2 <
    3674f780f47d2906b5a0f7199b66973067bdfeca
  - Linux 6.19
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:48:37.920Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89546'
references:
  - url: 'https://git.kernel.org/stable/c/6debde9e3e6ae21dcca75837b4247b13ca4ea2b8'
  - url: 'https://git.kernel.org/stable/c/3674f780f47d2906b5a0f7199b66973067bdfeca'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89546.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89546'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532175'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89546'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89546'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00553
epssPercentile: 0.46015
scores:
  cna: 9.8
  vendor: 5.3
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: close backchannel before destroying callback service

A backchannel receive can complete a request while the NFS callback
service is being torn down.  xprt_complete_bc_request() removes the
request from bc_pa_list, drops bc_alloc_count, marks the request in use,
and then asks xprt_enqueue_bc_request() to hand it to the callback
service.

If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request()
currently returns without enqueueing or freeing the committed request.
The xprt_get() taken on entry is leaked as well.  If the producer wins
the race before bc_serv is cleared, it can also enqueue onto sv_cb_list
after nfs_callback_down() has stopped the callback threads, leaving the
request linked to a svc_serv that is about to be freed.

Close the producer side before callback threads are stopped.  Add
xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call
it on callback shutdown and callback-start failure before stopping the
service threads.  Requests that lose the NULL transition in
xprt_enqueue_bc_request() are released through the normal backchannel
free path after balancing bc_slot_count.  Finally, drain any remaining
sv_cb_list requests after the callback threads have stopped and before
svc_destroy() frees the service.

## Affected

- `Linux >= 441244d4273a8037b265fd254dfdaca5fa736ee2 < 6debde9e3e6ae21dcca75837b4247b13ca4ea2b8`
- `Linux >= 441244d4273a8037b265fd254dfdaca5fa736ee2 < 3674f780f47d2906b5a0f7199b66973067bdfeca`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89546.json)