CVE-2026-89712

Status: UPDATED  |  Advisory ID: CVE-2026-89712

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with

list_for_each_entry_safe(ni, tmp, ...). For each expired entry it

sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the

source vfsmount, then reacquires the lock to list_del + kfree the

entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent

nfsd4_ssc_setup_dul() finders during the lock-drop window, but it

does not pin tmp. Another nfsd RPC thread that fails its source-

server mount and reaches nfsd4_ssc_cancel_dul() will, during that

same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount

item, and release the lock. If that item is the saved tmp of the

expire walk, the next iteration dereferences a freed

nfsd4_ssc_umount_item.

Restart the walk from the head after the mntput() unlock window so

no saved next pointer survives the lock-drop. The list is bounded

by the number of active inter-server source mounts (typically small)

and the expire delayed-work runs periodically rather than per-IO,

so the restart is cheap. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References