CVE-2026-89549 (CVSS 7.5)

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely. Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race().

Is your site exposed to CVE-2026-89549?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0072

Probability of exploitation

0.52%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/011479cf9a7657d4a3e7cc42a784ac63df594170 https://git.kernel.org/stable/c/6f66d38e2a6c78d48723ea17ad86135ec80ca24b https://git.kernel.org/stable/c/8f766d2d0b4dabf54f8b35812df2b4f481d13316 https://git.kernel.org/stable/c/9accc25e5af0bac8479f6054e674b2c593c45281 https://git.kernel.org/stable/c/9d04d64ad192439835ed9884d767353061c3ed6f https://git.kernel.org/stable/c/d79d7b9e8acbb53e2d60f6b24afc13e2f15e691f https://git.kernel.org/stable/c/edb20e8c03aebacb409968c99d046f509c6c485a https://git.kernel.org/stable/c/f6310491c4cdb88af73aa551ec9df1f10a90c709

Frequently Asked Questions

What is CVE-2026-89549? +

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely. Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race(). It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-89549? +

CVE-2026-89549 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0072, placing it in the 1th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-89549? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89549