Cloudanix VulnDB

CVE-2026-89678

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing service can cause files to be written at the wrong places when a write operation is only partly completed, resulting in corrupted or incorrect data for users of that service.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Flawed short-write detection in nfsd_direct_write() compares the post-write residual iter.count against host_err instead of the original segment length, allowing writes completing 50-99% of a segment to bypass the break condition; this advances kiocb->ki_pos by only the short amount and over-reports *cnt to the client.

Why it matters to the business

NFS clients may receive corrupted file contents or incorrect write acknowledgments, leading to application data integrity failures, silent corruption, and potential compliance or operational incidents on affected Linux servers.

How an attack unfolds

An attacker issues direct NFS WRITE requests that trigger partial writes (for example via resource limits or I/O errors); the incorrect residual-length comparison lets the loop continue with an understated ki_pos, placing subsequent segments at the wrong file offset and returning an inflated byte count to the client.

How to fix it

Apply the upstream kernel patch that snapshots segments[i].iter.count before vfs_iocb_iter_write() and compares host_err against the saved original length; rebuild and deploy the fixed kernel on all NFS servers.

How to confirm the fix worked

Inspect the nfsd_direct_write() source to confirm the pre-write snapshot and correct comparison are present; test with workloads that deliberately produce partial writes and verify correct offset advancement and byte counts.

Typical attack path

  1. Establish NFS mount to a vulnerable Linux nfsd server
  2. Issue large direct WRITE requests designed to produce short writes on some segments
  3. Trigger the miscalculated ki_pos advancement across segments
  4. Observe client-visible data corruption or over-reported write success

How to detect it

Review nfsd and kernel logs for repeated short-write patterns or offset anomalies; correlate client-reported write counts against server-side vfs_iocb_iter_write return values; no specific post-exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates on all systems exposing NFS over the network
  • Monitor vendor advisories for the exact fixed kernel versions once released
  • Temporarily restrict direct I/O or large writes on unpatched servers if feasible
  • Include the fix in the next planned kernel maintenance window

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list of write segments and, after each vfs_iocb_iter_write(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset: host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter); if (host_err < 0) return host_err; *cnt += host_err; if (host_err < segments[i].iter.count) break; /* partial write */ vfs_iocb_iter_write() runs the iter through ->write_iter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length: before write_iter: iter.count == original_len after write_iter: iter.count == original_len - host_err The condition then reduces to host_err < original_len - host_err, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->ki_pos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting *cnt to the NFS client. Snapshot the segment's byte count before the write and compare host_err against that snapshot so any short write breaks the loop.

Affected packages

Ecosystem Package Introduced Fixed