External risk intelligence

Linux Kernel SUNRPC Backchannel Request Leakage

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89546

The vulnerability exists within the Linux kernel SUNRPC backchannel mechanism, which is an internal component for NFS callback services. It is not a service directly exposed to the public internet but rather an internal protocol implementation component used between NFS client and server processes.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's SUNRPC component could allow an attacker to disrupt operations involving NFS callback services. While the direct impact is internal to these services, it highlights the need to ensure the integrity of core operating system components that underpin network file sharing.

Affects Linux kernel's internal network service.
Leadership should monitor relevant system integrity.
Confirm relevance and exposure of affected services.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition in the Linux kernel's SUNRPC implementation. If an attacker can trigger a specific timing during the shutdown of an NFS callback service, they might be able to send a request that is processed after the service has stopped accepting new requests. This could lead to a denial of service and potentially other impacts.

Entry condition: Network access to a vulnerable system.
Trigger point: Exploiting a race condition during service shutdown.
Resulting risk: Denial of service and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SUNRPC component could affect system stability and service availability under specific race conditions related to the handling of NFS callback requests. If a backchannel receive operation completes while the NFS callback service is being torn down, it may lead to resource leaks and an inconsistent service state. This could impact the reliability of NFS operations that rely on these callbacks when supported by the advisory.

System stability and service availability.
Race condition during service teardown.
Unreliable NFS callback operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SUNRPC component may require coordination between infrastructure or platform teams managing NFS services and potentially vendor-management teams if commercial NFS solutions are in use. The first practical step is to identify all systems running the affected kernel version that are involved in NFS callback operations, assess their exposure and business criticality, and confirm the responsible system owner. Remediation planning should then be prioritized based on this risk assessment.

Identify NFS callback service owners.
Verify service reachability and criticality.
Plan remediation with system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SUNRPC component used for?

SUNRPC stands for Sun Remote Procedure Call. In the Linux kernel, it provides the fundamental communication framework that allows Network File System (NFS) clients and servers to talk to each other. The backchannel mechanism specifically enables the server to send requests back to the client, which is essential for certain NFS operations like file delegation and layout management.

What kind of vulnerability is CVE-2026-89546?

This vulnerability is a race condition. It occurs due to flaws in how the kernel manages memory and request queues when an NFS callback service is shutting down. Because the system fails to properly coordinate the closing of the backchannel with the stopping of callback threads, it creates a state where requests are mishandled, potentially leading to memory leaks or service instability.

How can an attacker trigger this flaw?

An attacker needs network access to trigger the conditions for this race. The vulnerability is specifically tied to the precise timing of an NFS callback service teardown. Simply having an NFS connection is not enough; the error only manifests if a backchannel request is being processed exactly while the service is being stopped. Normal, stable operation of NFS services does not trigger this issue.

Do I need to worry about this if my NFS server is internal?

According to Halo Surface Signal, this component is an internal protocol implementation between NFS processes rather than a service directly exposed to the public internet. While the impact is largely internal, you should still evaluate if your NFS configurations are reachable by untrusted users or segments, as any network-based access to the affected system could theoretically allow an attacker to attempt to trigger the race condition.

When should I take action to address this issue?

The first step is to inventory your environment to identify which systems are running affected kernel versions and performing NFS callback operations. Prioritize this based on the business criticality of those file services. Coordinate with your infrastructure teams to assess service reachability and plan for a kernel update, as applying the official patches that ensure proper service shutdown is the standard way to resolve this.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.