EUVD-2026-76460
GHSA-j6w6-qx29-46gg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H reflects the mandatory non-default server-side configuration (pernode/percpu pool mode with thread count below NUMA node count); all other metrics match vendor assessment.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: route to a populated pool in svc_pool_for_cpu()
svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all.
svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services exclusively its own pool, so a transport that lands on a threadless pool is enqueued on sp_xprts and never picked up: the connection hangs indefinitely.
Have svc_pool_for_cpu() skip pools that currently have no threads, falling back to the next populated pool. This trades NUMA locality for a guarantee that the work is actually serviced. sp_nrthreads is only updated under the service mutex; the lockless read here is a best-effort routing hint, so annotate it with data_race().
AnalysisAI
NFS server availability in the Linux kernel SUNRPC subsystem can be disrupted when svc_pool_for_cpu() routes incoming transports to CPU-affine service pools that contain no active threads. Affected deployments running nfsd in pernode or percpu pool mode with fewer configured threads than NUMA nodes (or CPUs) will silently enqueue inbound NFS transports on threadless pools, where they are never picked up - causing NFS connections to hang indefinitely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: the Linux kernel NFS server (nfsd) must be running; the server must be configured in pernode or percpu pool mode (non-default on most distributions, typically set via the kernel's SVC pool mode parameter); and the number of configured nfsd threads must be strictly less than the number of NUMA nodes (pernode mode) or CPUs (percpu mode), leaving at least one pool with zero threads. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) overstates exploitability: AC:L implies any network client can trigger the DoS against a default-configured server, but the condition only manifests under a specific, non-default configuration (fewer nfsd threads than NUMA nodes in pernode/percpu mode). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.12.109 or later for the 6.12.x series, 6.18.50 or later for the 6.18.x series, 7.2.4 or later for the 7.2.x series, or any 7.3-rc1 or later commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running nfsd with pernode or percpu pool mode-prioritize those with thread counts below NUMA node or CPU count. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today