---
title: "CVE-2026-89712: Linux Kernel - Use After Free"
description: "Linux kernel contains a use-after-free vulnerability in NFSD nfsd4_ssc_expire_umount caused by improper handling of list iteration after dropping nfsd_ssc_lock, letting attackers cause denial of service by crashing the kernel, exploit requires concurrent NFS RPC threads."
url: https://panop.io/threat-heartbeat/CVE-2026-89712/
---

# CVE-2026-89712 Linux Kernel - Use After Free

Linux kernel contains a use-after-free vulnerability in NFSD nfsd4\_ssc\_expire\_umount caused by improper handling of list iteration after dropping nfsd\_ssc\_lock, letting attackers cause denial of service by crashing the kernel, exploit requires concurrent NFS RPC threads.

CVSS base score 9.8 /10

Critical

CISA KEV

Not listed

Public exploit

None known

EPSS

0.71% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89712)

## Details

Type

Use After Free

Impact

Denial Of Service

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the fix for NFSD nfsd4\_ssc\_expire\_umount.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89712](https://nvd.nist.gov/vuln/detail/CVE-2026-89712)
- [https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a](https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a)
- [https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea](https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea)
- [https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837](https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837)
- [https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93](https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93)
- [https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2](https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2)
- [https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5](https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5)
- [https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8](https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8)
- [https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9](https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)