Look up another CVE · open CVE-2026-89704 in the interactive tracker
CVE-2026-89704
nfsd: sample writeback error cursor before async COPY loop
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89704 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
_nfsd_copy_file_range() samples dst->f_wb_err into "since" after the copy loop, then uses it to detect writeback errors via filemap_check_wb_err() once vfs_fsync_range() returns. Because the nfsd_file cache reuses a single struct file across requests targeting the same inode, a concurrent COMMIT or stable WRITE on dst advances dst->f_wb_err to the current mapping->wb_err via file_check_and_advance_wb_err() during its own vfs_fsync_range(). If that advancement lands between the writeback error appearing in mapping->wb_err and the COPY worker sampling "since", the worker captures the already-advanced cursor, errseq_check() sees cur == since and returns zero, and NFSD4_COPY_F_COMMITTED is set even though writeback failed. CB_OFFLOAD then encodes wr_stable_how = FILE_SYNC4, the client treats the copied data as durable, and the failure becomes silent data loss. Sample since once at the start of the function. The cursor then reflects state in effect before this COPY issues any writes, and filemap_check_wb_err() detects any error that occurs during the copy regardless of which thread first observes it. This matches the pattern used by nfsd_vfs_write() and nfsd4_clone_file_range().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/nfsd/nfs4proc.c
- What this is
- KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
- Kernel module
- nfsd
Check it on the machine
grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nfsdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NFSD, CONFIG_NFSD_V4
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.53%, higher than 43.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/nfsd
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.124 | 5.10.270 | 435e4246c7df |
| 5.15.49 | 5.15.221 | 9f539a1c0791 |
| 5.17 | 6.1.188 | 4728504c0216 |
| 5.17 | 6.6.157 | 322422d66d1a |
| 5.17 | 6.12.109 | 52b2db7a72e1 |
| 5.17 | 6.18.50 | 8277d4a11ae2 |
| 5.17 | 7.2.4 | a1cbafe756cd |
| 5.17 | 7.3 | 20a67a7d1822 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- NFSv4.2 COPY is handled by in-kernel nfsd over TCP/UDP 2049; a remote client reaches _nfsd_copy_file_range() via COMPOUND SEQUENCE/PUTFH/OPEN/COPY with no local access on the server.
- AC:LAttack complexity, low
- The attacker issues async COPY and a concurrent COMMIT or stable WRITE on the same destination inode, which share one nfsd_file/struct file, and can force writeback errors via ENOSPC or quota and retry; both sides of the race are attacker-controlled.
- PR:NPrivileges required, none
- Typical nfsd exports use AUTH_SYS or AUTH_NULL with IP-based ACLs, so a network peer can spoof a UID, create an NFSv4.2 session, OPEN source and dest files, and issue COPY without a local account or capability on the NFS server.
- UI:NUser interaction, none
- The attacker sends the COPY and COMMIT RPCs themselves against an already-exported writable filesystem; no administrator or victim user action is required at exploit time.
- S:UScope, unchanged
- The missed writeback error only affects durability reporting and file data on the host running nfsd and does not cross a VM, IOMMU, or sandbox boundary.
- C:NConfidentiality impact, none
- This is a silent durability-reporting failure, not memory disclosure; there is no out-of-bounds read, use-after-free, or kernel pointer leak.
- I:HIntegrity impact, high
- When a concurrent COMMIT advances dst->f_wb_err before COPY samples it, CB_OFFLOAD encodes wr_stable_how=FILE_SYNC4 despite failed writeback, so clients treat the copied range as durable and the data is silently lost after crash or cache eviction.
- A:NAvailability impact, none
- The flaw does not oops, panic, deadlock, or hang nfsd; the server keeps running, and lost durability is an integrity failure rather than a kernel or NFS-service crash.