CVE-2026-89712
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
How to fix
- Linux Linux2b59029b8f24a99b5d844af2da3950d39d36eeea, d9e151fea5ed706c1284adacabd869b0be745db2, 659ee3da073164e1e6e40dfcbc26eeed85845f93, 60680ae7243b22de3d09be990d8e23bcfc4af837, 77de363d9a1c8cd35f20482782c612cda085791a, 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8, 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9, 036c1b182f4da65363e79ec0ac276edc6b7296e5, 5.10.270 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a4bc287943f5695209ff36bdc89f17b48d68fae7 ≤ v < 2b59029b8f24a99b5d844af2da3950d39d36eeea, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < d9e151fea5ed706c1284adacabd869b0be745db2, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 659ee3da073164e1e6e40dfcbc26eeed85845f93, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 60680ae7243b22de3d09be990d8e23bcfc4af837, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 77de363d9a1c8cd35f20482782c612cda085791a, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9, f4e44b393389c77958f7c58bf4415032b4cda15b ≤ v < 036c1b182f4da65363e79ec0ac276edc6b7296e5, 5.10.220 ≤ v < 5.10.270, 5.14 | 2b59029b8f24a99b5d844af2da3950d39d36eeea, d9e151fea5ed706c1284adacabd869b0be745db2, 659ee3da073164e1e6e40dfcbc26eeed85845f93, 60680ae7243b22de3d09be990d8e23bcfc4af837, 77de363d9a1c8cd35f20482782c612cda085791a, 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8, 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9, 036c1b182f4da65363e79ec0ac276edc6b7296e5, 5.10.270 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.