CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
list_for_each_entry_safe(ni, tmp, ...).  For each expired entry it
sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
source vfsmount, then reacquires the lock to list_del + kfree the
entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent
nfsd4_ssc_setup_dul() finders during the lock-drop window, but it
does not pin tmp.  Another nfsd RPC thread that fails its source-
server mount and reaches nfsd4_ssc_cancel_dul() will, during that
same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
item, and release the lock.  If that item is the saved tmp of the
expire walk, the next iteration dereferences a freed
nfsd4_ssc_umount_item.

Restart the walk from the head after the mntput() unlock window so
no saved next pointer survives the lock-drop.  The list is bounded
by the number of active inter-server source mounts (typically small)
and the expire delayed-work runs periodically rather than per-IO,
so the restart is cheap.

The Linux kernel CVE team has assigned CVE-2026-89712 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 6.12.109 with commit 77de363d9a1c8cd35f20482782c612cda085791a
	Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 6.18.50 with commit 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8
	Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 7.2.4 with commit 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9
	Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 7.3-rc1 with commit 036c1b182f4da65363e79ec0ac276edc6b7296e5
	Issue introduced in 5.10.220 with commit a4bc287943f5695209ff36bdc89f17b48d68fae7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89712
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfsd/nfs4state.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a
	https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8
	https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9
	https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5