CVE-2026-89712Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 5.3
none → medium
— → 9.8
none → critical
9.8 → 5.3
critical → medium
5.3 → 9.8
medium → critical
9.8 → 7
critical → high
0.2% → 0.8%
Last analysed / modified upstream
7 → 9.8
high → critical
In the Linux kernel, the following vulnerability has been resolved:
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer.
The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item.
Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
Linux >= a4bc287943f5695209ff36bdc89f17b48d68fae7 < 2b59029b8f24a99b5d844af2da3950d39d36eeeaLinux >= f4e44b393389c77958f7c58bf4415032b4cda15b < d9e151fea5ed706c1284adacabd869b0be745db2Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 659ee3da073164e1e6e40dfcbc26eeed85845f93Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 60680ae7243b22de3d09be990d8e23bcfc4af837Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 77de363d9a1c8cd35f20482782c612cda085791aLinux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 036c1b182f4da65363e79ec0ac276edc6b7296e5Linux >= 5.10.220 < 5.10.270Linux 5.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2022-50329High· 7.8In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), howev…
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…