UBUNTU-CVE-2026-89712: Critical severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount() walks nn->nfsdsscmountlist with listforeachentrysafe(ni, tmp, ...). For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput() on the source vfsmount, then reacquires the lock to listdel + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsuibusy flag protects the current ni from concurrent nfsd4sscsetupdul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4ssccanceldul() will, during that same window, take nfsdssclock, listdel + kfree its own sscumount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4sscumountitem. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.