CVE-2026-89712
nicheUse-after-free race in Linux kernel NFSD server-side-copy expiry (nfsd4_ssc_expire_umount)
The Linux kernel's NFS server (NFSD) contains a use-after-free in nfsd4_ssc_expire_umount(), which walks the nfsd_ssc_mount_list of inter-server-copy (SSC) source mounts. The walk drops nfsd_ssc_lock to call mntput() on an expired entry, but the list_for_each_entry_safe macro's saved 'next' pointer (tmp) is not protected during that window; a concurrent RPC thread whose source-server mount fails can, via nfsd4_ssc_cancel_dul(), free that exact entry, causing the resumed walk to dereference freed memory. The bug is triggered only on NFS servers that serve NFSv4.2 COPY operations backed by inter-server source mounts, when a mount failure races with the periodic SSC expiry delayed-work. Successful exploitation corrupts kernel memory, plausibly crashing the host or enabling kernel-level code execution, consistent with the worst-case CVSS 3.1 score of 9.8 (network, low complexity, no privileges or user interaction required). The flaw affects the Linux kernel's NFSD implementation wherever the SSC copy path is in use; no public proof of concept and no exploitation in the wild are known, and the issue is not on the CISA KEV list.
What to do: Update to a kernel release containing the fix (commit 'NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock') via your distribution's latest stable kernel packages. Audit NFS servers for exposure: the vulnerable path requires nfsd running with NFSv4.2 inter-server COPY (SSC) enabled, so hosts serving only NFSv3/v4.0/v4.1 or not using cross-server COPY are not reachable through this code. If patching must be delayed, restricting NFSv4.2 COPY operations from untrusted clients reduces the attack surface, and operators should monitor affected servers for nfsd-related kernel crashes or oopses as indicators of attempted races.
| Linux kernel (NFSD server-side copy / nfsd4_ssc_expire_umount) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.