Answer in brief
CVE-2026-89712 records a Unknown severity vulnerability in NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f4e44b393389c77958f7c58bf4415032b4cda15b <77de363d9a1c8cd35f20482782c612cda085791a || >=f4e44b393389c77958f7c58bf4415032b4cda15b <4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8 || >=f4e44b393389c77958f7c58bf4415032b4cda15b <7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9 || >=f4e44b393389c77958f7c58bf4415032b4cda15b <036c1b182f4da65363e79ec0ac276edc6b7296e5 || a4bc287943f5695209ff36bdc89f17b48d68fae7 || >=5.10.220 <5.11 | 77de363d9a1c8cd35f20482782c612cda085791a, 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8, 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9, 036c1b182f4da65363e79ec0ac276edc6b7296e5, 5.11 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
Quoted source text, attributed separately from HOL analysis.