Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:37.960Z",
  "pubdate": "2026-09-11T20:19:37.960Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel's SUNRPC (Remote Procedure Call) backchannel implementation, specifically during the teardown process of the NFS callback service.\nThe vulnerability occurs due to a race between the backchannel receive completion and the callback service shutdown sequence, potentially leading to memory leaks and use-after-free conditions.\nAffected systems include Linux kernel environments utilizing NFS callback services via SUNRPC.\nAn attacker may exploit this race condition by inducing specific timing windows during NFS callback service shutdown, which could lead to kernel memory corruption or a denial-of-service (DoS) condition by leaving requests linked to service structures that are no longer valid or in the process of being deallocated.\nSuccessful exploitation requires the ability to trigger callback service teardown while concurrent backchannel requests are in flight, and the risk is primarily associated with system instability or crashes due to invalid kernel memory references.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper synchronization between xprt_complete_bc_request() and the NFS callback service teardown mechanism. During the teardown process, the kernel invokes nfs_callback_down(), which stops callback threads. However, if a backchannel receive completes simultaneously, the kernel attempts to enqueue the request onto the callback service list.\nIf xprt->bc_serv is cleared before the request is enqueued by xprt_enqueue_bc_request(), the kernel fails to free the associated request and leaks an xprt_get() reference. Conversely, if the producer wins the race, it may enqueue a request onto sv_cb_list after the callback threads have already been terminated. This leaves the request linked to a svc_serv structure that is slated for destruction via svc_destroy().\nThe attack flow involves an adversary inducing a high frequency of RPC operations followed by an immediate shutdown of the callback service. By forcing a race where the backchannel producer operates just as the service structure is being invalidated, an attacker can leave the kernel in an inconsistent state.\nSpecifically, the vulnerable code path allows for: 1) A memory leak of the xprt reference count when xprt_enqueue_bc_request() terminates early without cleaning up the request; 2) A dangling pointer scenario where a request resides on the sv_cb_list after the service threads have been stopped, leading to potential use-after-free or kernel panic when svc_destroy() attempts to deallocate the service structure while items are still linked to it.\nThis vulnerability is localized to the interaction between the SUNRPC backchannel transport and the service management layer. Because the kernel relies on bc_pa_lock to protect state, the lack of a formal shutdown sequence for the producer side before thread termination breaks the atomicity required for safe teardown. The fix requires closing the producer side explicitly via a new function, xprt_svc_shutdown_bc(), which serializes the clearing of xprt->bc_serv and ensures that all remaining requests are drained or released through the correct backchannel free path before the service structure is finalized."
}