CVE-2026-89712 (GCVE-0-2026-89712)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a4bc287943f5695209ff36bdc89f17b48d68fae7 , < 2b59029b8f24a99b5d844af2da3950d39d36eeea (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < d9e151fea5ed706c1284adacabd869b0be745db2 (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 659ee3da073164e1e6e40dfcbc26eeed85845f93 (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 60680ae7243b22de3d09be990d8e23bcfc4af837 (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 77de363d9a1c8cd35f20482782c612cda085791a (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8 (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9 (git)
Affected: f4e44b393389c77958f7c58bf4415032b4cda15b , < 036c1b182f4da65363e79ec0ac276edc6b7296e5 (git)
Affected: 5.10.220 , < 5.10.270 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b59029b8f24a99b5d844af2da3950d39d36eeea",
              "status": "affected",
              "version": "a4bc287943f5695209ff36bdc89f17b48d68fae7",
              "versionType": "git"
            },
            {
              "lessThan": "d9e151fea5ed706c1284adacabd869b0be745db2",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "659ee3da073164e1e6e40dfcbc26eeed85845f93",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "60680ae7243b22de3d09be990d8e23bcfc4af837",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "77de363d9a1c8cd35f20482782c612cda085791a",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "036c1b182f4da65363e79ec0ac276edc6b7296e5",
              "status": "affected",
              "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.220",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.220",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock\n\nnfsd4_ssc_expire_umount() walks nn-\u003enfsd_ssc_mount_list with\nlist_for_each_entry_safe(ni, tmp, ...).  For each expired entry it\nsets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the\nsource vfsmount, then reacquires the lock to list_del + kfree the\nentry and continue iterating via the macro\u0027s saved tmp pointer.\n\nThe nsui_busy flag protects the current ni from concurrent\nnfsd4_ssc_setup_dul() finders during the lock-drop window, but it\ndoes not pin tmp.  Another nfsd RPC thread that fails its source-\nserver mount and reaches nfsd4_ssc_cancel_dul() will, during that\nsame window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount\nitem, and release the lock.  If that item is the saved tmp of the\nexpire walk, the next iteration dereferences a freed\nnfsd4_ssc_umount_item.\n\nRestart the walk from the head after the mntput() unlock window so\nno saved next pointer survives the lock-drop.  The list is bounded\nby the number of active inter-server source mounts (typically small)\nand the expire delayed-work runs periodically rather than per-IO,\nso the restart is cheap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is between nfsd4_ssc_expire_umount() and nfsd4_ssc_cancel_dul(); cancel_dul runs from nfsd4_copy() on NFSv4.2 OP_COPY, reached by a COMPOUND over TCP/2049 to in-kernel nfsd. A remote client populates nfsd_ssc_mount_list and frees the saved iterator with no local access.\nAC:L - The attacker drives both race sides with concurrent async inter-server COPY requests: completed copies leave expired nfsd4_ssc_umount_item entries for the laundromat, while a COPY to another source IP fails vfs_kern_mount() into cancel_dul() during mntput(). An attacker-controlled source NFS server can stall unmount, so the window is attacker-created and retryable.\nPR:N - Under AUTH_SYS (default for typical NFS deployments) the server verifies no secret; EXCHANGE_ID, CREATE_SESSION, and OPEN succeed for any host allowed by the export, so no server-verified privileges are required to issue the COPY compounds that hit setup_dul/cancel_dul.\nUI:N - The attacker\u2019s own NFS client issues the COPY compounds and source-server traffic that create, expire, and cancel ssc_umount items; no administrator or other user action on the victim server is required.\nS:U - The use-after-free is of a kmalloc\u2019d nfsd4_ssc_umount_item in the nfsd host kernel; impact stays within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After cancel_dul() kfree()s the saved tmp, the expire walk continues from a freed nfsd4_ssc_umount_item whose vfsmount, list links, and metadata the attacker can replace via slab reuse, giving a UAF read primitive over kernel heap.\nI:H - The expire path then writes nsui_busy, calls mntput() on attacker-controlled nsui_vfsmount, and runs list_del()/kfree() on poisoned pointers, yielding arbitrary-write and control-flow hijack primitives from the same UAF.\nA:H - Dereferencing the freed list node in nfsd4_ssc_expire_umount() oopses or panics the laundromat worker even without a full exploit, taking down the in-kernel NFS server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:11.760Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2"
        },
        {
          "url": "https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837"
        },
        {
          "url": "https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9"
        },
        {
          "url": "https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5"
        }
      ],
      "title": "NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89712",
    "datePublished": "2026-09-11T19:46:27.018Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-09-14T12:02:11.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89712",
      "date": "2026-09-21",
      "epss": "0.00704",
      "percentile": "0.51477"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4state.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2b59029b8f24a99b5d844af2da3950d39d36eeea",
                    "status": "affected",
                    "version": "a4bc287943f5695209ff36bdc89f17b48d68fae7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9e151fea5ed706c1284adacabd869b0be745db2",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "659ee3da073164e1e6e40dfcbc26eeed85845f93",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60680ae7243b22de3d09be990d8e23bcfc4af837",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77de363d9a1c8cd35f20482782c612cda085791a",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "036c1b182f4da65363e79ec0ac276edc6b7296e5",
                    "status": "affected",
                    "version": "f4e44b393389c77958f7c58bf4415032b4cda15b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.270",
                    "status": "affected",
                    "version": "5.10.220",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4state.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock\n\nnfsd4_ssc_expire_umount() walks nn-\u003enfsd_ssc_mount_list with\nlist_for_each_entry_safe(ni, tmp, ...).  For each expired entry it\nsets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the\nsource vfsmount, then reacquires the lock to list_del + kfree the\nentry and continue iterating via the macro\u0027s saved tmp pointer.\n\nThe nsui_busy flag protects the current ni from concurrent\nnfsd4_ssc_setup_dul() finders during the lock-drop window, but it\ndoes not pin tmp.  Another nfsd RPC thread that fails its source-\nserver mount and reaches nfsd4_ssc_cancel_dul() will, during that\nsame window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount\nitem, and release the lock.  If that item is the saved tmp of the\nexpire walk, the next iteration dereferences a freed\nnfsd4_ssc_umount_item.\n\nRestart the walk from the head after the mntput() unlock window so\nno saved next pointer survives the lock-drop.  The list is bounded\nby the number of active inter-server source mounts (typically small)\nand the expire delayed-work runs periodically rather than per-IO,\nso the restart is cheap."
          }
        ],
        "id": "CVE-2026-89712",
        "lastModified": "2026-09-14T13:19:21.077",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:58.620",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-21T17:07:07+00:00",
      "cve": "CVE-2026-89712",
      "id": "CVE-2026-89712",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89712.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:36:56Z",
      "cve": "CVE-2026-89712",
      "id": "CVE-2026-89712",
      "initial_release_date": "2026-09-12T16:23:09Z",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89712",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89712.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.