DEBIAN-CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: close backchannel before destroying callback service  A backchannel receive can complete a request while the NFS callback service is being torn down.  xprtcompletebcrequest() removes the request from bcpalist, drops bcalloccount, marks the request in use, and then asks xprtenqueuebcrequest() to hand it to the callback service.  If teardown has already cleared xprt->bcserv, xprtenqueuebcrequest() currently returns without enqueueing or freeing the committed request. The xprtget() taken on entry is leaked as well.  If the producer wins the race before bcserv is cleared, it can also enqueue onto svcblist after nfscallbackdown() has stopped the callback threads, leaving the request linked to a svcserv that is about to be freed.  Close the producer side before callback threads are stopped.  Add xprtsvcshutdownbc() to clear xprt->bcserv under bcpalock, and call it on callback shutdown and callback-start failure before stopping the service threads.  Requests that lose the NULL transition in xprtenqueuebcrequest() are released through the normal backchannel free path after balancing bcslotcount.  Finally, drain any remaining svcblist requests after the callback threads have stopped and before svc_destroy() frees the service.