SB20260912232 - Improper Check for Unusual or Exceptional Conditions in Linux kernel sunrpc

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89549)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a service connection to hang indefinitely.

The vulnerability exists due to improper handling of threadless service pools in svc_pool_for_cpu() when routing a transport to a service pool. A remote attacker can initiate a connection that is enqueued on a pool with no service threads to cause a service connection to hang indefinitely.

The condition can occur when a service has fewer threads than configured pools.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170
• https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316
• https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f
• https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709