CVE-2026-89701

Received Received - Intake

Integer Overflow in Linux Kernel NFSd TIME_DELEG Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms store a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this check but the TIME_DELEG paths do not. A malformed timespec can propagate through notify_change() to disk. Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89701

EUVD

EUVD-2026-76613

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of the nseconds field in TIME_DELEG operations. The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY paths store a raw uint32_t nseconds value directly into tv_nsec without ensuring it is less than NSEC_PER_SEC. This can lead to malformed timespec values propagating through notify_change() to disk storage.

Detection Guidance

This vulnerability affects the Linux kernel's NFS server implementation, specifically in the handling of TIME_DELEG requests. Detection requires checking kernel logs for malformed NFS requests or filesystem errors related to time attributes. Monitor logs for notify_change() errors or disk corruption events. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to craft malicious NFS requests that write invalid timespec values to disk. This might cause filesystem corruption, application crashes, or unexpected behavior in systems relying on NFS for file operations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to fix the missing nseconds validation in TIME_DELEG paths. Restart NFS services after patching. Monitor for signs of exploitation such as unexpected filesystem changes or errors in NFS-related logs.

Hi! I’m here to help you understand CVE-2026-89701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70