CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved:

NFSD: restart ssc expire umount walk after dropping nfsd ssc lock

nfsd4 ssc expire umount() walks nn->nfsd ssc mount list with list for each entry safe(ni, tmp, ...). For each expired entry it sets nsui busy = true, drops nfsd ssc lock to run mntput() on the source vfsmount, then reacquires the lock to list del + kfree the entry and continue iterating via the macro's saved tmp pointer.

The nsui busy flag protects the current ni from concurrent nfsd4 ssc setup dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4 ssc cancel dul() will, during that same window, take nfsd ssc lock, list del + kfree its own ssc umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4 ssc umount item.

Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.