CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved:

NFSD: restart sscexpireumount walk after dropping nfsdssclock

nfsd4sscexpireumount() walks nn->nfsdsscmountlist with

listforeachentrysafe(ni, tmp, ...).  For each expired entry it

sets nsuibusy = true, drops nfsdssc_lock to run mntput() on the

source vfsmount, then reacquires the lock to list_del + kfree the

entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent

nfsd4sscsetup_dul() finders during the lock-drop window, but it

does not pin tmp.  Another nfsd RPC thread that fails its source-

server mount and reaches nfsd4ssccancel_dul() will, during that

same window, take nfsdssclock, listdel + kfree its own sscumount

item, and release the lock.  If that item is the saved tmp of the

expire walk, the next iteration dereferences a freed

nfsd4sscumount_item.

Restart the walk from the head after the mntput() unlock window so

no saved next pointer survives the lock-drop.  The list is bounded

by the number of active inter-server source mounts (typically small)

and the expire delayed-work runs periodically rather than per-IO,

so the restart is cheap.