CVE-2026-89712: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89712 Overview

CVE-2026-89712 is a use-after-free vulnerability in the Linux kernel NFS server (NFSD) inter-server copy code. The flaw resides in nfsd4_ssc_expire_umount(), which walks the nn->nfsd_ssc_mount_list using list_for_each_entry_safe(). During the walk, the function drops nfsd_ssc_lock to run mntput() on the source vfsmount. Another NFSD RPC thread reaching nfsd4_ssc_cancel_dul() in that window can free the saved tmp iterator entry, causing the next iteration to dereference freed memory.

Critical Impact
Concurrent NFSD threads racing with the expiration walker can trigger memory corruption in kernel space, enabling denial of service or potential code execution.

Affected Products

Linux kernel with NFSD inter-server copy (SSC) support
Distributions shipping the affected NFSD code path prior to the referenced stable commits
Systems exposing NFSv4.2 server-side copy functionality

Discovery Timeline

2026-09-11 - CVE-2026-89712 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89712

Vulnerability Analysis

The vulnerability is a use-after-free in the NFSD server-side copy (SSC) subsystem. nfsd4_ssc_expire_umount() iterates the mount list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry, it sets nsui_busy = true, releases nfsd_ssc_lock, calls mntput() on the source vfsmount, then reacquires the lock to list_del and kfree the entry.

The nsui_busy flag pins only the current ni. It does not protect the tmp pointer saved by the safe-iteration macro. During the lock-drop window, another NFSD RPC thread whose source-server mount failed enters nfsd4_ssc_cancel_dul(), acquires nfsd_ssc_lock, and can list_del and kfree its own ssc_umount item. If that freed item is the walker's saved tmp, the next loop iteration dereferences a freed nfsd4_ssc_umount_item.

Root Cause

The root cause is unsafe list iteration across a lock-drop window. The list_for_each_entry_safe() macro guarantees safety only against removal of the current entry, not against concurrent removal of the next entry. Dropping nfsd_ssc_lock invalidates that guarantee.

Attack Vector

The attack requires an NFSv4.2 server configured with inter-server copy. An attacker able to trigger source-server mount failures concurrent with expiration of other cached mounts can race nfsd4_ssc_cancel_dul() against nfsd4_ssc_expire_umount() to free the walker's tmp iterator.

The upstream fix restarts the walk from the list head after each mntput() unlock window so no saved next pointer survives the lock drop. The list is bounded by the number of active inter-server source mounts and the expire delayed-work runs periodically, making the restart inexpensive. See Kernel Commit 036c1b1 and Kernel Commit 77de363 for the corrective patches.

Detection Methods for CVE-2026-89712

Indicators of Compromise

Kernel oops or panic traces referencing nfsd4_ssc_expire_umount, nfsd4_ssc_cancel_dul, or nfsd4_ssc_umount_item
KASAN reports of use-after-free in the NFSD SSC code path
Unexpected NFSD worker crashes coinciding with inter-server copy activity

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during NFSv4.2 inter-server copy stress tests
Correlate nfsd thread crashes with NFSv4.2 COPY operations targeting failing source servers
Monitor kernel ring buffer for list corruption warnings from lib/list_debug.c on NFSD hosts

Monitoring Recommendations

Aggregate kernel logs from NFSD hosts into a centralized log store and alert on BUG:, general protection fault, or KASAN entries
Track NFSv4.2 COPY request volume and error rates on file servers
Baseline nfsd_ssc_mount_list churn using kernel tracepoints during maintenance windows

How to Mitigate CVE-2026-89712

Immediate Actions Required

Apply the stable kernel updates that restart the SSC expiration walk after each mntput() unlock window
Prioritize patching NFS servers that expose NFSv4.2 inter-server copy to untrusted clients
Restrict network access to NFSD ports (TCP/2049) to trusted subnets until patches are deployed

Patch Information

The fix has been merged across multiple stable kernel branches. Reference commits: 036c1b1, 2b59029, 4ed8d23, 60680ae, 659ee3d, 7377fa9, 77de363, and d9e151f. Consult your distribution's advisories to identify the corresponding backported package.

Workarounds

Disable NFSv4.2 inter-server copy on the NFS server if the workload does not require it
Block NFSv4.2 COPY operations at the network layer where feasible
Limit NFSD exports to trusted client networks to reduce race trigger opportunities