{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89713", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.751Z", "datePublished": "2026-09-11T19:46:27.752Z", "dateUpdated": "2026-10-21T12:48:27.026Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:48:27.026Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.\nAC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.\nPR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner's uid.\nUI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.\nS:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.\nC:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.\nI:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.\nA:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "52d0c5bdfe232c9974d4b11f97078b9c7814f05d", "status": "affected", "versionType": "git"}, {"version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24", "status": "affected", "versionType": "git"}, {"version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d", "status": "affected", "versionType": "git"}, {"version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "44086254479035de42ca3d286ecf25521d4e6325", "status": "affected", "versionType": "git"}, {"version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f", "status": "affected", "versionType": "git"}, {"version": "604a3c407026d6162d15300478e63f901e435efc", "status": "affected", "versionType": "git"}, {"version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5", "status": "affected", "versionType": "git"}, {"version": "3ee4f442e5b37a537297b812557b1163f96b5399", "status": "affected", "versionType": "git"}, {"version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44", "status": "affected", "versionType": "git"}, {"version": "982898d7f97a35447403c3fcecc0d96c646ce101", "status": "affected", "versionType": "git"}, {"version": "3.2.89", "lessThan": "3.3", "status": "affected", "versionType": "semver"}, {"version": "3.16.44", "lessThan": "3.17", "status": "affected", "versionType": "semver"}, {"version": "4.4.53", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.14", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.10.2", "lessThan": "4.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d"}, {"url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"}, {"url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"}, {"url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"}, {"url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"}], "title": "NFSD: check truncate permission under inode lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:26:29.958634Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:36:59.626Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:26:29.958634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:30.995Z"}}], "cna": {"title": "NFSD: check truncate permission under inode lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.\nAC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.\nPR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner's uid.\nUI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.\nS:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.\nC:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.\nI:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.\nA:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "52d0c5bdfe232c9974d4b11f97078b9c7814f05d", "versionType": "git"}, {"status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24", "versionType": "git"}, {"status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d", "versionType": "git"}, {"status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "44086254479035de42ca3d286ecf25521d4e6325", "versionType": "git"}, {"status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f", "versionType": "git"}, {"status": "affected", "version": "604a3c407026d6162d15300478e63f901e435efc", "versionType": "git"}, {"status": "affected", "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5", "versionType": "git"}, {"status": "affected", "version": "3ee4f442e5b37a537297b812557b1163f96b5399", "versionType": "git"}, {"status": "affected", "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44", "versionType": "git"}, {"status": "affected", "version": "982898d7f97a35447403c3fcecc0d96c646ce101", "versionType": "git"}, {"status": "affected", "version": "3.2.89", "lessThan": "3.3", "versionType": "semver"}, {"status": "affected", "version": "3.16.44", "lessThan": "3.17", "versionType": "semver"}, {"status": "affected", "version": "4.4.53", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.14", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.10.2", "lessThan": "4.11", "versionType": "semver"}], "programFiles": ["fs/nfsd/vfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/vfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d"}, {"url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"}, {"url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"}, {"url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"}, {"url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.2.89"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.16.44"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.53"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.10.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:48:27.026Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89713", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:48:27.026Z", "dateReserved": "2026-09-11T19:38:34.751Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:46:27.752Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "52d0c5bdfe232c9974d4b11f97078b9c7814f05d", "status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "versionType": "git"}, {"lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24", "status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "versionType": "git"}, {"lessThan": "d8352da196349182e1afd5a93308256cddc0a97d", "status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "versionType": "git"}, {"lessThan": "44086254479035de42ca3d286ecf25521d4e6325", "status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "versionType": "git"}, {"lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f", "status": "affected", "version": "783112f7401ff449d979530209b3f6c2594fdb4e", "versionType": "git"}, {"status": "affected", "version": "604a3c407026d6162d15300478e63f901e435efc", "versionType": "git"}, {"status": "affected", "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5", "versionType": "git"}, {"status": "affected", "version": "3ee4f442e5b37a537297b812557b1163f96b5399", "versionType": "git"}, {"status": "affected", "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44", "versionType": "git"}, {"status": "affected", "version": "982898d7f97a35447403c3fcecc0d96c646ce101", "versionType": "git"}, {"lessThan": "3.3", "status": "affected", "version": "3.2.89", "versionType": "semver"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.44", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.53", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.14", "versionType": "semver"}, {"lessThan": "4.11", "status": "affected", "version": "4.10.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load."}], "id": "CVE-2026-89713", "lastModified": "2026-10-21T13:20:22.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89713", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:26:29.958634Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:58.743", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel NFSD: Unauthorized truncation of append-only files via TOCTOU vulnerability", "id": "2532459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532459"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A remote attacker, by sending a crafted file attribute modification request (SETATTR) while a file is being concurrently appended, could exploit a time-of-check to time-of-use (TOCTOU) vulnerability. This could lead to the unauthorized truncation of append-only files, potentially resulting in data loss."], "name": "CVE-2026-89713", "public_date": "2026-09-11T19:46:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89713\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89713\nhttps://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24\nhttps://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325\nhttps://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f\nhttps://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[783112f7401ff449d979530209b3f6c2594fdb4e,3afa17d93ba8c925f49370c816c6dae5112d8c24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[783112f7401ff449d979530209b3f6c2594fdb4e,d8352da196349182e1afd5a93308256cddc0a97d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[783112f7401ff449d979530209b3f6c2594fdb4e,44086254479035de42ca3d286ecf25521d4e6325)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[783112f7401ff449d979530209b3f6c2594fdb4e,b778e0e0a16759f22a70579c3cf8d254a40d4a7f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "604a3c407026d6162d15300478e63f901e435efc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3ee4f442e5b37a537297b812557b1163f96b5399"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "982898d7f97a35447403c3fcecc0d96c646ce101"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.89,3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.44,3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.53,4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.14,4.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.10.2,4.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.109,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.50,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.4,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T08:15:07.026344+00:00", "updated": "2026-09-15T19:30:12.151830+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}