NFSD: check truncate permission under inode lock

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89713
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:58 UTC
Updated2026-10-16 20:18:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

Risk And Classification

Primary CVSS: v3.1 9.1 CRITICAL from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.006030000 probability, percentile 0.470080000 (date 2026-09-14)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
3.1CNADECLARED9.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 783112f7401ff449d979530209b3f6c2594fdb4e 3afa17d93ba8c925f49370c816c6dae5112d8c24 git Not specified
CNA Linux Linux affected 783112f7401ff449d979530209b3f6c2594fdb4e d8352da196349182e1afd5a93308256cddc0a97d git Not specified
CNA Linux Linux affected 783112f7401ff449d979530209b3f6c2594fdb4e 44086254479035de42ca3d286ecf25521d4e6325 git Not specified
CNA Linux Linux affected 783112f7401ff449d979530209b3f6c2594fdb4e b778e0e0a16759f22a70579c3cf8d254a40d4a7f git Not specified
CNA Linux Linux affected 604a3c407026d6162d15300478e63f901e435efc git Not specified
CNA Linux Linux affected cc4d5dc73841b98d33cdfb9822d70b0aac4beca5 git Not specified
CNA Linux Linux affected 3ee4f442e5b37a537297b812557b1163f96b5399 git Not specified
CNA Linux Linux affected a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44 git Not specified
CNA Linux Linux affected 982898d7f97a35447403c3fcecc0d96c646ce101 git Not specified
CNA Linux Linux affected 3.2.89 3.3 semver Not specified
CNA Linux Linux affected 3.16.44 3.17 semver Not specified
CNA Linux Linux affected 4.4.53 4.5 semver Not specified
CNA Linux Linux affected 4.9.14 4.10 semver Not specified
CNA Linux Linux affected 4.10.2 4.11 semver Not specified
CNA Linux Linux affected 4.11 Not specified
CNA Linux Linux unaffected 4.11 semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report