CVE-2026-89712

A flaw was found in the Linux kernel's Network File System Daemon (NFSD) component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, another NFS Remote Procedure Call (RPC) thread can free memory that the first thread subsequently attempts to access. This use-after-free vulnerability could allow a remote attacker to cause a denial of service.

An NFS server side copy expiry race can dereference a freed nfsd4_ssc_umount_item because nfsd4_ssc_expire_umount drops nfsd_ssc_lock around mntput while the saved next list entry is not pinned. A concurrent nfsd RPC thread can delete and free that saved next entry via nfsd4_ssc_cancel_dul, so the expire walk can continue with a stale pointer. This is a race based use after free in the NFSD control path for inter server copy cleanup. For the CVSS the PR:L is selected because the attacker normally needs network access as an NFS client able to exercise server side copy or related source mount failure paths, but does not need local shell access on the server. The issue is network reachable through NFS service behavior rather than generic packet processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.