CVE-2026-89712
CVE CVE-2026-89712EUVD EUVD-2026-76624Published 2026-09-11T19:46:27.000ZLast changed 2026-09-14T12:02:11.000ZCVSS 9.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 5.14; patch: 6.1.188; patch: 5.15.221; f4e44b393389c77958f7c58bf4415032b4cda15b <7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9; patch: 6.12.109; patch: 6.18.50; f4e44b393389c77958f7c58bf4415032b4cda15b <659ee3da073164e1e6e40dfcbc26eeed85845f93; f4e44b393389c77958f7c58bf4415032b4cda15b <d9e151fea5ed706c1284adacabd869b0be745db2; patch: 7.3-rc1; patch: 7.2.4; patch: 0; patch: 5.10.270; f4e44b393389c77958f7c58bf4415032b4cda15b <60680ae7243b22de3d09be990d8e23bcfc4af837; 5.10.220 <5.10.270; f4e44b393389c77958f7c58bf4415032b4cda15b <77de363d9a1c8cd35f20482782c612cda085791a; patch: 6.6.157; a4bc287943f5695209ff36bdc89f17b48d68fae7 <2b59029b8f24a99b5d844af2da3950d39d36eeea; f4e44b393389c77958f7c58bf4415032b4cda15b <4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8; f4e44b393389c77958f7c58bf4415032b4cda15b <036c1b182f4da65363e79ec0ac276edc6b7296e5
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.