CVE-2026-89713

Received Received - Intake

Time-of-Use Race Condition in Linux Kernel NFSD

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89713

EUVD

EUVD-2026-76625

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a time-of-check to time-of-use (TOCTOU) race condition in the NFS daemon (NFSD). The issue occurs in nfsd_setattr() where a file size check for truncation permission is performed before acquiring the inode lock, but the actual truncation happens later under the lock. This allows a concurrent append operation to extend the file, bypassing the append-only restriction and leading to unauthorized truncation.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and requires kernel-level inspection. Detection involves checking if your system is running a vulnerable kernel version and verifying the presence of the affected nfsd_setattr function behavior. Use commands like 'uname -a' to check kernel version and 'dmesg | grep nfsd' to look for NFS-related errors. If you suspect exploitation, monitor for unexpected file truncations or permission changes in append-only files.

Impact Analysis

If exploited, this vulnerability could allow an attacker with access to an NFS share to bypass file append-only restrictions, potentially causing data loss by truncating files that should not be modified. This could affect the integrity of critical files on systems relying on NFS for file sharing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to file truncation permissions under inode locks, which could lead to unauthorized file modifications in specific scenarios. Compliance implications would depend on how the vulnerability is exploited in a system handling regulated data.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution to patch the vulnerability. If immediate patching is not possible, restrict access to NFS shares by disabling them temporarily or limiting client access. Monitor file system logs for suspicious truncation attempts and ensure append-only files are properly protected with immutable flags where applicable.

Hi! I’m here to help you understand CVE-2026-89713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70