CVE-2026-89678

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89678", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.747Z", "datePublished": "2026-09-11T19:46:02.184Z", "dateUpdated": "2026-10-19T08:50:51.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:50:51.587Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix partial-write detection in nfsd_direct_write\n\nnfsd_direct_write() walks a list of write segments and, after each\nvfs_iocb_iter_write(), tries to detect a short write so the loop can\nstop before placing the next segment at a wrong file offset:\n\n host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);\n if (host_err < 0)\n return host_err;\n *cnt += host_err;\n if (host_err < segments[i].iter.count)\n break;\t/* partial write */\n\nvfs_iocb_iter_write() runs the iter through ->write_iter(), which\nadvances the iter by the number of bytes written. By the time the\ncheck runs, segments[i].iter.count is the residual, not the original\nrequest length:\n\n before write_iter: iter.count == original_len\n after write_iter: iter.count == original_len - host_err\n\nThe condition then reduces to host_err < original_len - host_err, so\nthe break fires only when less than half of the segment was written.\nAny short write completing between 50% and 99% of the segment slips\nthrough; the loop advances to the next segment with kiocb->ki_pos\nonly bumped by the short amount, writing the next segment's payload\nat the wrong offset and over-reporting *cnt to the NFS client.\n\nSnapshot the segment's byte count before the write and compare\nhost_err against that snapshot so any short write breaks the loop."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - nfsd_direct_write() is reached from NFSv2/v3 WRITE (nfsd_proc_write/nfsd3_proc_write) and NFSv4 WRITE (nfsd4_write) in the in-kernel NFS server via svc_recv/svc_process over TCP/UDP 2049, so a remote client supplies the payload, offset, and length on the wire.\nAC:L - On nfsd hosts with io_cache_write=DIRECT, the attacker chooses WRITE offset and size to force a prefix/middle/suffix split (nsegs>=2) and can induce a 50-99% short write via quota, ENOSPC, or a concurrent truncate they also send; no race or layout outside their control is required.\nPR:N - Typical nfsd deployments accept AUTH_SYS/AUTH_NULL with IP-based export ACLs, so a network peer can MOUNT/LOOKUP, spoof an owner UID, and issue WRITE without cryptographic authentication or a local account on the NFS server.\nUI:N - The attacking NFS client sends the WRITE RPC itself; no separate victim user or administrator action on the server is required at attack time beyond nfsd already exporting a writable filesystem with direct writes enabled.\nS:U - Misplaced writes and the over-reported WRITE count affect only file data on the host running nfsd, remaining in that kernel/filesystem security authority without crossing a VM, IOMMU, or sandbox boundary.\nC:N - The bug only writes the client's own payload at a shifted file offset and over-reports the WRITE byte count; it does not read kernel memory or other inodes and is not a use-after-free or out-of-bounds read.\nI:H - After a 50-99% short write the loop continues and places the next segment at ki_pos advanced only by the short count, silently storing payload at the wrong file offset and over-reporting *cnt so clients treat corrupted server data as fully committed; when uncertain versus Low, High is required.\nA:N - The defect corrupts file contents and the NFS WRITE count without oops, panic, BUG_ON, deadlock, or hang; files remain accessible and nfsd workers continue, so there is no kernel or service crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "lessThan": "fa6590dfd16ab55f03b658b079072ace3504825e", "status": "affected", "versionType": "git"}, {"version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "lessThan": "250ec14932d5cfe102f68a57892bb566eee7f83e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"}, {"url": "https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e"}], "title": "nfsd: fix partial-write detection in nfsd_direct_write", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa6590dfd16ab55f03b658b079072ace3504825e", "status": "affected", "version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "versionType": "git"}, {"lessThan": "250ec14932d5cfe102f68a57892bb566eee7f83e", "status": "affected", "version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix partial-write detection in nfsd_direct_write\n\nnfsd_direct_write() walks a list of write segments and, after each\nvfs_iocb_iter_write(), tries to detect a short write so the loop can\nstop before placing the next segment at a wrong file offset:\n\n host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);\n if (host_err < 0)\n return host_err;\n *cnt += host_err;\n if (host_err < segments[i].iter.count)\n break;\t/* partial write */\n\nvfs_iocb_iter_write() runs the iter through ->write_iter(), which\nadvances the iter by the number of bytes written. By the time the\ncheck runs, segments[i].iter.count is the residual, not the original\nrequest length:\n\n before write_iter: iter.count == original_len\n after write_iter: iter.count == original_len - host_err\n\nThe condition then reduces to host_err < original_len - host_err, so\nthe break fires only when less than half of the segment was written.\nAny short write completing between 50% and 99% of the segment slips\nthrough; the loop advances to the next segment with kiocb->ki_pos\nonly bumped by the short amount, writing the next segment's payload\nat the wrong offset and over-reporting *cnt to the NFS client.\n\nSnapshot the segment's byte count before the write and compare\nhost_err against that snapshot so any short write breaks the loop."}], "id": "CVE-2026-89678", "lastModified": "2026-10-19T09:18:06.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:54.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: NFS daemon (nfsd) data corruption due to incorrect partial-write detection", "id": "2532180", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532180"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-823", "details": ["A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The `nfsd_direct_write()` function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic for detecting short writes compares the actual bytes written against a residual count rather than the original requested length. As a result, partial writes between 50% and 99% of the intended size are not properly identified, leading to subsequent data being written at incorrect file offsets and the NFS client receiving an inaccurate report of bytes written. This can allow a remote attacker to cause data corruption on the NFS server."], "name": "CVE-2026-89678", "public_date": "2026-09-11T19:46:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89678\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89678\nhttps://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e\nhttps://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06c5c97293e3fca99ce15da157068edf45a7c6e4,fa6590dfd16ab55f03b658b079072ace3504825e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06c5c97293e3fca99ce15da157068edf45a7c6e4,250ec14932d5cfe102f68a57892bb566eee7f83e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T04:45:07.679153+00:00", "updated": "2026-09-15T20:30:10.337536+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}