DEBIAN-CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved:  NFSD: restart sscexpireumount walk after dropping nfsdssclock  nfsd4sscexpireumount() walks nn->nfsdsscmountlist with listforeachentrysafe(ni, tmp, ...).  For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput() on the source vfsmount, then reacquires the lock to listdel + kfree the entry and continue iterating via the macro's saved tmp pointer.  The nsuibusy flag protects the current ni from concurrent nfsd4sscsetupdul() finders during the lock-drop window, but it does not pin tmp.  Another nfsd RPC thread that fails its source- server mount and reaches nfsd4ssccanceldul() will, during that same window, take nfsdssclock, listdel + kfree its own sscumount item, and release the lock.  If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4sscumountitem.  Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop.  The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.