{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-89547",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89547",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-11T19:44:22.644Z",
    "updatedAt": "2026-10-19T08:48:38.898Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "SUNRPC: Check svc pool percpu counter allocation",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Check svc pool percpu counter allocation\n\n__svc_create() initializes three per-pool percpu_counter stats and\nignores every return value. On SMP, percpu_counter_init() fails when\n__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed\ncounter with fbc->counters == NULL and its embedded raw_spinlock_t,\nlist_head, and count never initialized. __svc_create() returns the\nhalf-constructed svc_serv to nfsd, lockd, or the NFS callback service\nanyway.\n\nOnce that service is live, the hot-path increments in\nsvc_xprt_enqueue(), svc_handle_xprt(), and\nsvc_pool_wake_idle_thread() reach a counter whose backing pointer is\nNULL. The pointer is a per-cpu offset, so the access does not fault:\nit resolves to offset zero of the current CPU's per-cpu area and\nsilently corrupts whatever variable lives there. A\n/proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and\nreturns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on\nthe never-initialized lock.\n\nCreating the broken service requires a percpu allocation failure during\nRPC server startup, so it is reachable only by a local administrator\nunder memory pressure or fault injection; a remote peer cannot induce\nthe bad state on its own.\n\nCheck each percpu_counter_init() return value in __svc_create() and\nfail when an allocation fails, unwinding the counters already set up\nin the current pool and in every pool initialized before it. A\ndiscrete percpu_counter_destroy() per counter at teardown frees each\nper-cpu allocation exactly once.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ccf08bed6e7a80519569456edd2ea21b7b1701c6",
              "status": "affected",
              "versionType": "git",
              "lessThan": "57ac7d899409b0a9b768cf417e3bb86bcca3d4c6"
            },
            {
              "version": "ccf08bed6e7a80519569456edd2ea21b7b1701c6",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3a2b7649de76376a69f1d3ed2a539fb15907cd4d"
            },
            {
              "version": "ccf08bed6e7a80519569456edd2ea21b7b1701c6",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bd1ef2cfb44d72b7aa6943e87b206eb0e30fbd0c"
            },
            {
              "version": "ccf08bed6e7a80519569456edd2ea21b7b1701c6",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b541a15046976e481618726cc23db0fb22d576db"
            },
            {
              "version": "ccf08bed6e7a80519569456edd2ea21b7b1701c6",
              "status": "affected",
              "versionType": "git",
              "lessThan": "43e11e164704dde975c9edb370de1a06bec67270"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.3",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.3"
            },
            {
              "version": "6.6.157",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.109",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.50",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}