{"api_version":"1","generated_at":"2026-09-12T04:34:23+00:00","cve":"CVE-2026-89713","urls":{"html":"https://cve.report/CVE-2026-89713","api":"https://cve.report/api/cve/CVE-2026-89713.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89713","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89713"},"summary":{"title":"NFSD: check truncate permission under inode lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:58","updated_at":"2026-09-11 20:19:58"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f","name":"https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d","name":"https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325","name":"https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24","name":"https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89713","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89713","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 783112f7401ff449d979530209b3f6c2594fdb4e 3afa17d93ba8c925f49370c816c6dae5112d8c24 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 783112f7401ff449d979530209b3f6c2594fdb4e d8352da196349182e1afd5a93308256cddc0a97d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 783112f7401ff449d979530209b3f6c2594fdb4e 44086254479035de42ca3d286ecf25521d4e6325 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 783112f7401ff449d979530209b3f6c2594fdb4e b778e0e0a16759f22a70579c3cf8d254a40d4a7f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 604a3c407026d6162d15300478e63f901e435efc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cc4d5dc73841b98d33cdfb9822d70b0aac4beca5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3ee4f442e5b37a537297b812557b1163f96b5399 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 982898d7f97a35447403c3fcecc0d96c646ce101 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.2.89 3.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.16.44 3.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.4.53 4.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.14 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.10.2 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nfsd/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3afa17d93ba8c925f49370c816c6dae5112d8c24","status":"affected","version":"783112f7401ff449d979530209b3f6c2594fdb4e","versionType":"git"},{"lessThan":"d8352da196349182e1afd5a93308256cddc0a97d","status":"affected","version":"783112f7401ff449d979530209b3f6c2594fdb4e","versionType":"git"},{"lessThan":"44086254479035de42ca3d286ecf25521d4e6325","status":"affected","version":"783112f7401ff449d979530209b3f6c2594fdb4e","versionType":"git"},{"lessThan":"b778e0e0a16759f22a70579c3cf8d254a40d4a7f","status":"affected","version":"783112f7401ff449d979530209b3f6c2594fdb4e","versionType":"git"},{"status":"affected","version":"604a3c407026d6162d15300478e63f901e435efc","versionType":"git"},{"status":"affected","version":"cc4d5dc73841b98d33cdfb9822d70b0aac4beca5","versionType":"git"},{"status":"affected","version":"3ee4f442e5b37a537297b812557b1163f96b5399","versionType":"git"},{"status":"affected","version":"a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44","versionType":"git"},{"status":"affected","version":"982898d7f97a35447403c3fcecc0d96c646ce101","versionType":"git"},{"lessThan":"3.3","status":"affected","version":"3.2.89","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.44","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.53","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.14","versionType":"semver"},{"lessThan":"4.11","status":"affected","version":"4.10.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nfsd/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.89","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.44","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.53","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:46:27.752Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"},{"url":"https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"},{"url":"https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"},{"url":"https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"}],"title":"NFSD: check truncate permission under inode lock","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89713","datePublished":"2026-09-11T19:46:27.752Z","dateReserved":"2026-09-11T19:38:34.751Z","dateUpdated":"2026-09-11T19:46:27.752Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:58","lastModifiedDate":"2026-09-11 20:19:58","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89713","Ordinal":"1","Title":"NFSD: check truncate permission under inode lock","CVE":"CVE-2026-89713","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89713","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load.","Type":"Description","Title":"NFSD: check truncate permission under inode lock"}]}}}