CVE-2026-89712 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89712

This Linux kernel NFSD vulnerability is a use-after-free in nfsd4_ssc_expire_umount(). When the function drops nfsd_ssc_lock to call mntput() on a source vfsmount, a concurrent nfsd4_ssc_cancel_dul() thread can free the saved tmp pointer that the list_for_each_entry_safe macro relies on to contin...