Linux NFSD: use-after-free in the inter-server copy mount expiry walk

Impact

nfsd4_ssc_expire_umount() drops nfsd_ssc_lock to run mntput(), but the saved next pointer of its list walk is not pinned. Another nfsd thread whose source-server mount fails can free that exact entry in the window, so the expiry work then dereferences freed memory. This is kernel memory corruption inside the NFS server, reachable through ordinary NFSv4.2 server-to-server COPY traffic, and it lands in a kernel thread rather than a syscall context, so the likely outcome is a host crash or worse on a node that is also serving GPU jobs. The record carries no exploitation evidence; NVD's AV:N/PR:N 9.8 score reflects the remote-trigger path, not a demonstrated takeover. Only servers that export NFS and have inter-server copy in use are affected.

Who can reach it

A client that can reach the NFS server and drive NFSv4.2 inter-server COPY, plus concurrent failing source-server mounts. No local access needed; NFS-level authentication applies as configured on the export.

What to do

Take the stable-tree fix (the walk is restarted from the list head after the mntput window) and reboot each NFS server node. There is no runtime knob for the race itself; if you cannot reboot promptly, disabling NFSv4.2 inter-server copy on the export removes the code path. No fixed release number is stated in the record beyond the stable commits.

References

Related entries

• Linux kernel qla2xxx: double completion in async IOCB timeout frees a live stack frameCVE-2026-89847 · Linux kernel qla2xxx (async IOCB timeout completion handling)Critical
• Linux kernel qla2xxx: NVMe LS reject path advances the request ring without the qpair lockCVE-2026-89857 · Linux kernel qla2xxx (NVMe-FC LS reject, request ring locking)Critical
• Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive bufferCVE-2026-89969 · Linux kernel nvmet-tcp (NVMe-over-TCP target PDU receive)Critical
• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical
• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical
• Linux kernel CephFS client: use-after-free when an MDS session reopens during an access checkCVE-2026-89990 · Linux kernel CephFS client (ceph_mds_check_access)Critical