CVE-2026-89547

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the SUNRPC component, the svc create() function initializes three per-pool percpu counter stats but fails to check the return values. On SMP systems, if percpu counter init() fails due to alloc percpu gfp() being unable to satisfy the allocation, the counter is left with fbc->counters as NULL, leaving the embedded raw spinlock t, list head, and count uninitialized. The function then returns a partially constructed svc serv to the nfsd, lockd, or NFS callback service.

When the service is active, increments in the functions svc xprt enqueue(), svc handle xprt(), and svc pool wake idle thread() access a NULL backing pointer. Because the pointer is a per-cpu offset, it resolves to offset zero of the current CPU's per-cpu area, leading to silent corruption of variables located there. Additionally, reading /proc/fs/nfsd/pool stats may return garbage data or cause a system crash on configurations using CONFIG DEBUG SPINLOCK or lockdep due to the uninitialized lock. This state can only be reached by a local administrator under memory pressure or through fault injection during RPC server startup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.