CVE-2026-89712NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a4bc287943f5695209ff36bdc89f17b48d68fae7 before 2b59029b8f24a99b5d844af2da3950d39d36eeea; from f4e44b393389c77958f7c58bf4415032b4cda15b before d9e151fea5ed706c1284adacabd869b0be745db2; from f4e44b393389c77958f7c58bf4415032b4cda15b before 659ee3da073164e1e6e40dfcbc26eeed85845f93; from f4e44b393389c77958f7c58bf4415032b4cda15b before 60680ae7243b22de3d09be990d8e23bcfc4af837; from f4e44b393389c77958f7c58bf4415032b4cda15b before 77de363d9a1c8cd35f20482782c612cda085791a; from f4e44b393389c77958f7c58bf4415032b4cda15b before 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8; from f4e44b393389c77958f7c58bf4415032b4cda15b before 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9; from f4e44b393389c77958f7c58bf4415032b4cda15b before 036c1b182f4da65363e79ec0ac276edc6b7296e5; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea
- https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2
- https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93
- https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837
- https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a
- https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8
- https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9
- https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.