From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0173F585970 for ; Fri, 11 Sep 2026 20:03:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157033; cv=none; b=tZ5yJCzH5lSGDFkW/GO2jwFEsTdFrxAKNexh2jil+drKx11oVtLpWrDOsrVp4UTcaCjhWUgSPC7xk3BAS6VjOP4zRgxetX8fKwkOTXkGGoZls45ZUrGaiJ+8nlZ2FoaBsLB1oLcJfSlUtyXuu4N6S66qEkj6vjEcb+xVdxsKvZg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157033; c=relaxed/simple; bh=N1NZmGCNTBK0jT3WutndAiNJDk01zTbBThixP4zNZT4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GnxgerLYSS3VeHfl/IhqlRQCYtYYnCGoHVvulq8K/6qfW/nPzSlJM70VC6gh1gX5FM9O4pvXKDp+GqO3V5KJX8fbkCVD4p307uOnFf55dWpuYHcl2zJSLuP99VBkBQpkKyZfw4n35ygrArgUh/jLnUwxTNxHcHIPt+qYg7VBctQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HjRtjebW; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="HjRtjebW" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 430591F0089A; Fri, 11 Sep 2026 20:03:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789157024; bh=3/lgbzSp+/qK25VpsqR7QRvFTt4VquQdp1VARl2gGB8=; h=From:To:Cc:Subject:Date:Reply-To; b=HjRtjebWTS8NcC4MeskP3OCL/2OPLB8EadL8n31M3yDMAh+MN9fYt1Yb7FJjCCiEZ XcynNvDlfg1l++imUwQBA+4rIRss0yw2o02JzL/RmNTG5/qHc5252+YENj5+Aa9nA1 FpFF2ZmuTYMdYhiPmciRWlGoiGD1NsvX6zKhQE78= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Date: Fri, 11 Sep 2026 21:46:41 +0200 Message-ID: <2026091158-CVE-2026-89712-8db4@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3419; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=w/1qO6vGhdnU+cIRs3xA6zZLNPWCAXPg7MZ45Yn/2qk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLItum7Hm4aeNv4fc/AnSfJCiKm6sen5gfVvl71zOPK Qyurz7YdcSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBE+A4zzJWr8Z5w9BXLqnov o1veSz1ytj8/Mo9hflGecgf72sjoy1En7Kvfb5c8OG+eIAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap. The Linux kernel CVE team has assigned CVE-2026-89712 to this issue. Affected and fixed versions =========================== Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 6.12.109 with commit 77de363d9a1c8cd35f20482782c612cda085791a Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 6.18.50 with commit 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8 Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 7.2.4 with commit 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9 Issue introduced in 5.14 with commit f4e44b393389c77958f7c58bf4415032b4cda15b and fixed in 7.3-rc1 with commit 036c1b182f4da65363e79ec0ac276edc6b7296e5 Issue introduced in 5.10.220 with commit a4bc287943f5695209ff36bdc89f17b48d68fae7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89712 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfsd/nfs4state.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8 https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9 https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5