CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: close backchannel before destroying callback service

A backchannel receive can complete a request while the NFS callback service is being torn down. xprt complete bc request() removes the request from bc pa list, drops bc alloc count, marks the request in use, and then asks xprt enqueue bc request() to hand it to the callback service.

If teardown has already cleared xprt->bc serv, xprt enqueue bc request() currently returns without enqueueing or freeing the committed request. The xprt get() taken on entry is leaked as well. If the producer wins the race before bc serv is cleared, it can also enqueue onto sv cb list after nfs callback down() has stopped the callback threads, leaving the request linked to a svc serv that is about to be freed.

Close the producer side before callback threads are stopped. Add xprt svc shutdown bc() to clear xprt->bc serv under bc pa lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt enqueue bc request() are released through the normal backchannel free path after balancing bc slot count. Finally, drain any remaining sv cb list requests after the callback threads have stopped and before svc destroy() frees the service.