CVE-2026-89666
NoneCVSS
—
EPSS
0.2%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in Linux file servers lets a remote client send bad timestamp numbers that get written to disk and permanently scramble the recorded dates on files.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Tampering
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Client-supplied NFSv3 atime/mtime values with nseconds >= NSEC_PER_SEC are accepted without validation, pass through timestamp_truncate() and inode setters when s_time_gran==1, and are stored verbatim, causing ext4_encode_extra_time() and XFS bigtime to overflow the extra/epoch fields and corrupt on-disk seconds values.
Why it matters to the business
Filesystem metadata can become permanently inconsistent, producing wrong file modification and access years that break backups, compliance records, and forensic timelines; the issue affects any NFSv3 server using ext4 or XFS with nanosecond timestamps.
How an attack unfolds
An attacker mounts an NFSv3 share and issues SETATTR, CREATE, MKDIR, SYMLINK or MKNOD operations containing a valid wire-encoded uint32 nseconds value that is >= 1e9; the server stores the malformed timespec64 directly, later corrupting the on-disk inode timestamps when the filesystem writes the extra time fields.
How to fix it
Apply the upstream kernel commit that adds nseconds range checks in the NFSv3 proc handlers for SETATTR and the create operations; rebuild and reboot any affected NFS servers; until patched, restrict NFSv3 access to trusted clients only.
How to confirm the fix worked
Confirm the presence of the range-validation logic in nfsd3_proc_setattr and the create handlers; attempt a SETATTR with nseconds=1000000000 and verify NFS3ERR_INVAL is returned before any inode modification occurs.
Typical attack path
- Mount target NFSv3 export from attacker-controlled client
- Craft SETATTR or create-family request with atime/mtime nseconds >= NSEC_PER_SEC
- Send request; server accepts it and performs notify_change without clamping
- Filesystem writes corrupted extra-time field, permanently altering stored seconds/epoch
- Subsequent stat or backup operations observe incorrect year on the affected inode
How to detect it
Review NFS server logs for repeated NFS3ERR_INVAL responses on SETATTR or create operations; inspect ext4 or XFS inodes showing timestamps with years far outside expected ranges after an NFSv3 client connection.
What your security team should do
- Prioritize patching all Linux NFS servers within the next maintenance window
- Add network segmentation or export-level client allow-lists for any remaining unpatched systems
- Monitor kernel changelogs for the exact commit that landed the nseconds check
The record
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on the wire and decodes cleanly into a valid uint32, but it is not a valid timespec64: tv_nsec must be less than NSEC_PER_SEC. Nothing in the setattr path clamps it. notify_change() runs the time through timestamp_truncate(), which does not reduce tv_nsec below NSEC_PER_SEC when the filesystem supports nanosecond granularity (s_time_gran == 1), and the inode atime/mtime setters store it verbatim (only ctime is normalized, via inode_set_ctime_to_ts()). The un-normalized value then corrupts on-disk metadata: ext4's ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which overflows the 32-bit extra field and clobbers the seconds-epoch bits, so the stored seconds (and thus the year) are wrong on read-back. XFS with bigtime mis-stores the timestamp for the same reason. Validate the client-supplied atime/mtime in the proc handlers and return NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL for SETATTR and describes it as the error for a value the server 'can not store ... in its own representation'; the client maps it to EINVAL. Checking in the proc handlers, rather than in nfsd_setattr(), keeps the rejection in front of object creation. The create operations create the object before nfsd_create_setattr() runs, so a late failure would leave the new object behind and turn a non-idempotent request into a namespace change that reports failure. The check is therefore done up front, for the create operations before the object is created. tv_nsec is a long, so the comparison casts it to unsigned long (the same width) rather than to u32, matching timespec64_valid(). A u32 cast would truncate on 64-bit; the unsigned long cast also rejects a value that became negative when an out-of-range u32 wire nseconds was assigned to a 32-bit long. Only client-supplied times are checked: SET_TO_SERVER_TIME requests carry no client value. The sattrguard3 ctime is deliberately left alone: an out-of-range guard simply never matches the object's ctime and yields NFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the protocol-correct outcome rather than rejecting the request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|