CVE-2026-89691

In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.

In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.

In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.

In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().

In the Linux kernel, the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. A malicious client could send a malformed timespec that propagated through notify_change() to disk.

In the Linux kernel, the nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller could send a 16-byte address with sa_family=AF_INET6, causing a 12-byte out-of-bounds read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).

In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.

In the Linux kernel, struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as plain struct sockaddr (16 bytes). With an IPv6 NFS client connected, nfsd_genl_rpc_status_compose_msg() cast these fields to struct sockaddr_in6 (28 bytes), reading 8 bytes past the field and shipping a truncated IPv6 address plus part of rq_flags to userspace via netlink.

In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.

In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.