CRITICAL
nfsd SetAttr Bypass
CVE-2026-89697
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().
02KernelScan AI Analysis
Risk summary
An NFS client sending a SETATTR request that sets both file timestamps triggers a code path that skips acquiring the mount write reference, allowing attribute modifications to proceed without the protection that prevents concurrent filesystem freeze or unmount. This can lead to integrity violations on frozen or read-only filesystems and potential availability issues. Any device running an NFS server reachable by clients is affected.
Vulnerability analysis
In the NFS server's SETATTR handler, when both access and modification timestamps are specified, the code verifies the file handle early so that attribute preparation can inspect the dentry. This early verification causes the shared attribute-setting routine to believe a write reference has already been acquired and skip its own acquisition call, so the final attribute change operation runs without holding the mount write reference that guards against concurrent filesystem freezing or unmounting. The fix adds the missing write reference acquisition immediately after the early verification, restoring the invariant before any modification occurs. The vulnerability is reachable over the network by any NFS client that can send a SETATTR request to the server, requiring only normal access to the exported filesystem rather than root or special kernel capabilities on the server.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | — | 5.15.221 | 215030513488 |
| 6.6 | — | 6.6.157 | 15ca3b64a69c |
| 6.12 | — | 6.12.109 | 533964d420d3 |
| 6.18 | — | 6.18.50 | c4a409b86a92 |
| 7.2 | — | 7.2.4 | 4e475be769aa |
| mainline | — | 7.3-rc1 | — |
| 3.18 | 3.18.46 | 3.19 | 3eec9d791968 |
| 5.10 | — | 5.10.270 | 9229d824b938 |
| 6.1 | — | 6.1.188 | d823bf9285cd |
| cip/6.12 | — | 6.12.111-cip32 | 15ca3b64a69c |