Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_serv

Impact

A NFSv4 backchannel receive can complete while the callback service is being torn down. If bc_serv is already cleared, the committed request is neither enqueued nor freed and the transport reference taken on entry is leaked; if the producer wins the race, it can enqueue onto sv_cb_list after the callback threads have stopped, leaving a request linked to a svc_serv that is about to be freed. On a GPU node that unmounts NFSv4 while the server is still sending callbacks - a normal event during job teardown or a storage failover - this is either a slow leak or a use-after-free in the host kernel.

Who can reach it

Driven by the NFSv4 server: a backchannel request arriving as the client shuts its callback service down. Any server the node mounts, or a peer able to answer for it, can time traffic into that window; no separate client-side authentication is involved.

What to do

Install a stable kernel with xprt_svc_shutdown_bc() and the sv_cb_list drain (commits in the record). No runtime workaround. Rolling the kernel means draining and rebooting each NFSv4 client node.

References

Related entries

• Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored
• Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX boundCVE-2026-89551 · Linux kernel SUNRPC xdr_buf_trim (buf->len underflow)Unscored
• Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-freeCVE-2026-89570 · Linux kernel CXL MCE notifier (per-memdev registration lifetime)Unscored
• Linux kernel CXL fwctl: unchecked op_size reads past the input buffer and into the device mailboxCVE-2026-89571 · Linux kernel CXL features fwctl (cxlctl_fw_rpc op_size validation)Unscored
• Linux kernel BPF: preemptible bpf_get_stack reuses a per-CPU callchain buffer and writes out of boundsCVE-2026-89580 · Linux kernel BPF __bpf_get_stack (per-CPU callchain entry reuse)Unscored