CVE-2026-89712

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with

list_for_each_entry_safe(ni, tmp, ...). For each expired entry it

sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the

source vfsmount, then reacquires the lock to list_del + kfree the

entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent

nfsd4_ssc_setup_dul() finders during the lock-drop window, but it

does not pin tmp. Another nfsd RPC thread that fails its source-

server mount and reaches nfsd4_ssc_cancel_dul() will, during that

same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount

item, and release the lock. If that item is the saved tmp of the

expire walk, the next iteration dereferences a freed

nfsd4_ssc_umount_item.

Restart the walk from the head after the mntput() unlock window so

no

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References