CVE-2026-89712: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-cfxc-m2r2-5grw
Share
CVSS 9.8
Published
Advisory Summary

CVE-2026-89712 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89712 at a Glance

CVE Identifier CVE-2026-89712
GHSA Identifier GHSA-cfxc-m2r2-5grw
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-89712

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89712, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.

References

NVD — CVE-2026-89712 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89712
git.kernel.org/stable/c/036c1b182f... WEB
https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5
git.kernel.org/stable/c/2b59029b8f... WEB
https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea
git.kernel.org/stable/c/4ed8d2317a... WEB
https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8
git.kernel.org/stable/c/60680ae724... WEB
https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837
git.kernel.org/stable/c/659ee3da07... WEB
https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93
git.kernel.org/stable/c/7377fa964b... WEB
https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9
git.kernel.org/stable/c/77de363d9a... WEB
https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a
git.kernel.org/stable/c/d9e151fea5... WEB
https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2

Frequently Asked Questions

What is CVE-2026-89712?
CVE-2026-89712 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89712?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-89712?
CVE-2026-89712 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-89712?
CVE-2026-89712 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89712?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cfxc-m2r2-5grw",
  "modified" : "2026-09-14T15:32:34Z",
  "published" : "2026-09-11T21:31:37Z",
  "aliases" : [ "CVE-2026-89712" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock\n\nnfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with\nlist_for_each_entry_safe(ni, tmp, ...).  For each expired entry it\nsets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the\nsource vfsmount, then reacquires the lock to list_del + kfree the\nentry and continue iterating via the macro's saved tmp pointer.\n\nThe nsui_busy flag protects the current ni from concurrent\nnfsd4_ssc_setup_dul() finders during the lock-drop window, but it\ndoes not pin tmp.  Another nfsd RPC thread that fails its source-\nserver mount and reaches nfsd4_ssc_cancel_dul() will, during that\nsame window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount\nitem, and release the lock.  If that item is the saved tmp of the\nexpire walk, the next iteration dereferences a freed\nnfsd4_ssc_umount_item.\n\nRestart the walk from the head after the mntput() unlock window so\nno saved next pointer survives the lock-drop.  The list is bounded\nby the number of active inter-server source mounts (typically small)\nand the expire delayed-work runs periodically rather than per-IO,\nso the restart is cheap.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89712"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/036c1b182f4da65363e79ec0ac276edc6b7296e5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2b59029b8f24a99b5d844af2da3950d39d36eeea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4ed8d2317aef21cc2a9e5a55d6b59860b4b151a8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/60680ae7243b22de3d09be990d8e23bcfc4af837"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/659ee3da073164e1e6e40dfcbc26eeed85845f93"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7377fa964b8aaf47cb04e5efcc4c82d15e8c2ce9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/77de363d9a1c8cd35f20482782c612cda085791a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d9e151fea5ed706c1284adacabd869b0be745db2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:58Z"
  }
}