Cloudanix VulnDB

CVE-2026-89712

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A memory-handling mistake in the Linux kernel's file-sharing server component can let attackers crash servers or potentially take them over completely.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nfsd4_ssc_expire_umount() when the saved tmp pointer from list_for_each_entry_safe becomes invalid after another nfsd thread frees the nfsd4_ssc_umount_item during the nfsd_ssc_lock drop window around mntput().

Why it matters to the business

Kernel memory corruption on systems running the Linux NFS server with inter-server source mounts enabled can lead to system crashes, denial of service, or potential remote code execution with full host compromise.

How an attack unfolds

An attacker triggers concurrent nfsd RPC threads that perform source-server mounts and cancellations while the expire delayed work is walking the nfsd_ssc_mount_list; by racing the lock-drop window the attacker forces the expire walker to dereference a freed item, achieving use-after-free.

How to fix it

Apply the upstream fix that restarts the list walk from the head after each mntput unlock window; update to a kernel containing the resolution for this use-after-free.

How to confirm the fix worked

Confirm the patched kernel source contains the restart-from-head logic in nfsd4_ssc_expire_umount and that the nsui_busy flag is no longer relied upon to protect the iteration pointer; recompile and boot test with NFS server workloads exercising inter-server mounts.

Typical attack path

  1. Enable or reach an NFS server with nfsd_ssc_mount_list entries
  2. Initiate concurrent NFSv4 operations that call nfsd4_ssc_setup_dul and nfsd4_ssc_cancel_dul
  3. Force the periodic nfsd4_ssc_expire_umount delayed work to run during the race window
  4. Trigger list_del + kfree of the tmp item from the second thread
  5. Continue the list walk to dereference the freed nfsd4_ssc_umount_item

How to detect it

Inspect kernel logs for use-after-free or slab corruption reports mentioning nfsd_ssc or nfsd4_ssc_expire_umount; correlate with NFS RPC activity and delayed-work scheduling around mount list operations.

What your security team should do

  • Prioritize patching all Linux systems exposing NFS services within the next maintenance window
  • Disable NFS server-side copy features if not required until patched
  • Monitor for kernel oops or slab corruption logs on NFS servers

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.

Affected packages

Ecosystem Package Introduced Fixed