CVE-2026-89549
Description
A flaw was found in the sunrpc component of the Linux kernel. When the nfsd service runs with fewer threads than available pools, a transport can be routed to a pool with no active threads. This prevents the connection from being processed, causing it to hang indefinitely. This can lead to a Denial of Service (DoS) condition for affected services.
Statement
A flaw in the sunrpc subsystem of the Linux kernel, rated MODERATE severity by Red Hat Product Security, affects Red Hat Enterprise Linux (kernel and kernel-rt), the RHCOS 8 and RHCOS 9 kernels shipped with OpenShift Container Platform 4 and 5, and Red Hat In-Vehicle OS. When the nfsd service runs with fewer threads than it has pools -- for example, an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- svc_xprt_enqueue() selects the pool from the CPU servicing the transport and queues the transport on that pool's sp_xprts, waking only a thread from the same pool. If the selected pool has no threads, the transport is enqueued but never picked up, because each nfsd thread services exclusively its own pool, and the connection hangs indefinitely. The result is a denial of service limited to the availability of the affected NFS service; there is no impact on confidentiality or integrity. The RHEL 6 ELS kernel is out of support scope (OOSS).
Red Hat rates this flaw MODERATE (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org score of 7.5, because triggering the hang requires a specific local nfsd configuration -- fewer threads than pools in a multi-pool mode such as "pernode" or "percpu" -- rather than a straightforward remotely exploitable condition. Fixes for the affected Red Hat products are currently deferred because the flaw is MODERATE severity with a CVSS score below 7.0, for which Red Hat Product Security does not prioritize fixes in these products. The residual risk is a denial of service against nfsd on hosts configured in the vulnerable state: connections routed to a threadless pool hang indefinitely.
Mitigation
The vulnerable condition exists only when nfsd runs with fewer threads than it has pools. Ensure nfsd is configured with at least one thread per pool -- for example, at least as many nfsd threads as the host has NUMA nodes when running in "pernode" mode, or CPUs when running in "percpu" mode -- so that no pool is left without threads. Alternatively, avoiding the multi-pool "pernode"/"percpu" nfsd modes prevents the vulnerable configuration. A fix for the affected Red Hat products is currently deferred; once a fixed kernel becomes available, upgrading to it will remove the vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
