CVE-2026-89712
Received Received - Intake

Use-After-Free in Linux Kernel NFSD

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89712
EUVD
EUVD-2026-76624

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition occurs during cleanup of expired NFS server-side copy (SSC) mounts. The issue happens when the nfsd4_ssc_expire_umount function iterates through a list of mounts to expire. If another thread deletes an entry during a lock-drop window, the iterator's saved next pointer may point to freed memory, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and requires kernel-level inspection. Detection involves checking kernel logs for crashes or errors related to nfsd4_ssc_expire_umount or nfsd4_ssc_setup_dul. Commands like dmesg | grep nfsd or journalctl -k | grep nfsd may help identify issues.

Impact Analysis

This vulnerability could lead to system crashes, kernel memory corruption, or potential privilege escalation if exploited. Systems using NFS with server-side copy functionality may be affected, potentially causing instability or denial of service.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patching is not immediately possible, consider disabling NFSv4.2+ server-side copy (SSC) functionality by setting the kernel parameter nfsd.ssc=0 or unloading the nfsd module if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart