Vulnerability-Lookup

CVE-2026-89713 (GCVE-0-2026-89713)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33

Title

NFSD: check truncate permission under inode lock

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3afa17d93ba8c925f…
https://git.kernel.org/stable/c/d8352da196349182e…
https://git.kernel.org/stable/c/44086254479035de4…
https://git.kernel.org/stable/c/b778e0e0a16759f22…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 783112f7401ff449d979530209b3f6c2594fdb4e , < 3afa17d93ba8c925f49370c816c6dae5112d8c24 (git) Affected: 783112f7401ff449d979530209b3f6c2594fdb4e , < d8352da196349182e1afd5a93308256cddc0a97d (git) Affected: 783112f7401ff449d979530209b3f6c2594fdb4e , < 44086254479035de42ca3d286ecf25521d4e6325 (git) Affected: 783112f7401ff449d979530209b3f6c2594fdb4e , < b778e0e0a16759f22a70579c3cf8d254a40d4a7f (git) Affected: 604a3c407026d6162d15300478e63f901e435efc (git) Affected: cc4d5dc73841b98d33cdfb9822d70b0aac4beca5 (git) Affected: 3ee4f442e5b37a537297b812557b1163f96b5399 (git) Affected: a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44 (git) Affected: 982898d7f97a35447403c3fcecc0d96c646ce101 (git) Affected: 3.2.89 , < 3.3 (semver) Affected: 3.16.44 , < 3.17 (semver) Affected: 4.4.53 , < 4.5 (semver) Affected: 4.9.14 , < 4.10 (semver) Affected: 4.10.2 , < 4.11 (semver)	guessed
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "44086254479035de42ca3d286ecf25521d4e6325",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "604a3c407026d6162d15300478e63f901e435efc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ee4f442e5b37a537297b812557b1163f96b5399",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982898d7f97a35447403c3fcecc0d96c646ce101",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.89",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.53",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.14",
              "versionType": "semver"
            },
            {
              "lessThan": "4.11",
              "status": "affected",
              "version": "4.10.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.89",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.10.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.\nAC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.\nPR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner\u0027s uid.\nUI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.\nS:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.\nC:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.\nI:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.\nA:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:36.076Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"
        },
        {
          "url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"
        },
        {
          "url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"
        }
      ],
      "title": "NFSD: check truncate permission under inode lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89713",
    "datePublished": "2026-09-11T19:46:27.752Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-09-13T06:33:36.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89713",
      "date": "2026-09-13",
      "epss": "0.00603",
      "percentile": "0.46984"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89713\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:58.743\",\"lastModified\":\"2026-09-13T07:17:37.013\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSD: check truncate permission under inode lock\\n\\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\\nbefore it takes inode_lock(). The comparison uses the file size sampled\\nby that unlocked read, but the actual ATTR_SIZE update is applied later\\nunder inode_lock() by notify_change().\\n\\nThis leaves a TOCTOU window for append-only files. If a client sends a\\nSETATTR that does not shrink the file at the time of the unlocked\\nsample, a concurrent append can extend the file before nfsd_setattr()\\ntakes inode_lock(). notify_change() then applies a real truncation\\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\\ntruncate syscall paths perform their own append-only checks before\\ncalling notify_change(), so NFSD must make this decision against the\\nlocked size it is about to change.\\n\\nSplit the write-count acquisition from the truncation permission check.\\nKeep get_write_access() before the locked setattr work, then recheck\\nwhether the requested size is below i_size_read(inode) after inode_lock()\\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\\nthe plain unlocked inode-\u003ei_size load.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"783112f7401ff449d979530209b3f6c2594fdb4e\",\"lessThan\":\"3afa17d93ba8c925f49370c816c6dae5112d8c24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"783112f7401ff449d979530209b3f6c2594fdb4e\",\"lessThan\":\"d8352da196349182e1afd5a93308256cddc0a97d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"783112f7401ff449d979530209b3f6c2594fdb4e\",\"lessThan\":\"44086254479035de42ca3d286ecf25521d4e6325\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"783112f7401ff449d979530209b3f6c2594fdb4e\",\"lessThan\":\"b778e0e0a16759f22a70579c3cf8d254a40d4a7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604a3c407026d6162d15300478e63f901e435efc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc4d5dc73841b98d33cdfb9822d70b0aac4beca5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3ee4f442e5b37a537297b812557b1163f96b5399\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"982898d7f97a35447403c3fcecc0d96c646ce101\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.2.89\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.16.44\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.53\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.14\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.10.2\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T07:01:05+00:00",
      "cve": "CVE-2026-89713",
      "id": "CVE-2026-89713",
      "initial_release_date": "2026-09-11T19:46:27.752000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel NFSD: Unauthorized truncation of append-only files via TOCTOU vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89713.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-12T16:23:07Z",
      "cve": "CVE-2026-89713",
      "id": "CVE-2026-89713",
      "initial_release_date": "2026-09-12T16:23:07Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89713",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89713.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2026-89713

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-13 07:17

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "44086254479035de42ca3d286ecf25521d4e6325",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "604a3c407026d6162d15300478e63f901e435efc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ee4f442e5b37a537297b812557b1163f96b5399",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982898d7f97a35447403c3fcecc0d96c646ce101",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.89",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.53",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.14",
              "versionType": "semver"
            },
            {
              "lessThan": "4.11",
              "status": "affected",
              "version": "4.10.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load."
    }
  ],
  "id": "CVE-2026-89713",
  "lastModified": "2026-09-13T07:17:37.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:58.743",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-V99P-5H33-35P9

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

NFSD: check truncate permission under inode lock

nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change().

This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change.

Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89713"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:58Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load.",
  "id": "GHSA-v99p-5h33-35p9",
  "modified": "2026-09-13T09:32:28Z",
  "published": "2026-09-11T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89713"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-89713 (GCVE-0-2026-89713)

FKIE_CVE-2026-89713

GHSA-V99P-5H33-35P9

Tags

Sightings

Nomenclature