Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu stats

Impact

__svc_create() ignores the return value of three per-pool percpu_counter_init() calls. If one fails, the counter is left with a NULL backing pointer and an uninitialized lock, and the half-built svc_serv is still handed to nfsd, lockd, or the NFS callback service. Hot-path increments then resolve to offset zero of the current CPU's per-cpu area and silently corrupt whatever variable lives there, /proc/fs/nfsd/pool_stats returns garbage, and debug builds splat on the uninitialized spinlock. The commit message is explicit that reaching this state needs a percpu allocation failure during RPC server startup, so it is a local-administrator-under-memory-pressure or fault-injection condition - a remote peer cannot induce it. The NVD 8.1 remote score overstates the real reach.

Who can reach it

Local: whoever starts the RPC server (nfsd, lockd, NFS callback) on a node already under enough memory pressure that a percpu allocation fails, or someone with fault-injection access. No remote trigger.

What to do

Apply the stable fix, which checks each percpu_counter_init() and unwinds the counters already set up on failure, then reboot the node. No runtime mitigation; avoiding nfsd startup on a memory-exhausted node reduces the chance of hitting it. The record names stable commits, not a released version.

References

Related entries

• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High
• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh