CVE-2026-89697

Received Received - Intake

Linux kernel NFS SETATTR missing fh_want_write reference

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89697

EUVD

EUVD-2026-76609

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing write lock reference during file attribute changes in the NFS server (nfsd). When handling SETATTR operations, the code verifies file handles early but fails to acquire a write lock before calling notify_change(), which could lead to race conditions or improper file system state changes.

Impact Analysis

This vulnerability could allow attackers to manipulate file attributes in a way that causes system instability, data corruption, or unauthorized access if exploited. Users relying on NFS for file sharing may experience unexpected behavior or crashes.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-89697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70