CVE-2026-89549 Linux CVE debrief

Who should care

Linux kernel administrators and defenders should assess exposure and prioritize patching for services with uneven thread and pool configurations. Defenders should prioritize verifying and applying patches for Linux kernel services with uneven thread and pool configurations to prevent connection hangs and potential exposure. Linux kernel administrators and defenders should review Linux kernel configurations for potential exposure and monitor Linux kernel

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel services with uneven thread and pool configurations to prevent connection hangs and potential exposure.

• Verify Linux kernel configurations to prevent connection hangs
• Apply patches to ensure svc_pool_for_cpu() function works correctly
• Monitor Linux kernel services for potential exposure

Technical summary

The svc_pool_for_cpu() function in the Linux kernel has been updated to skip pools with no threads, ensuring that work is actually serviced. This change addresses a vulnerability where transports would be enqueued on sp_xprts and never picked up, leading to a connection hang indefinitely. The vulnerability occurs when a service runs fewer threads than it has pools, causing trailing pools to be left with no threads. This results in transports being enqueued on sp_xprts and never picked up, leading to a connection hang indefinitely. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread services

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel services with uneven thread and pool configurations.

Recommended defensive actions

• Verify and apply patches for Linux kernel services with uneven thread and pool configurations
• Review Linux kernel configurations for potential exposure
• Monitor Linux kernel services for connection hangs
• Verify Linux kernel configurations to prevent connection hangs
• Apply patches to ensure svc_pool_for_cpu() function works correctly
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited. Official sources indicate the vulnerability has been resolved in the Linux kernel. The svc_pool_for_cpu() function has been updated to skip pools with no threads, ensuring that work is actually serviced. This change addresses a vulnerability where transports would be enqueued on sp_xprts and never picked up, leading to a connection hang indefinitely. Defenders should prioritize verifying and applying patches for Linux kernel services with

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.