Cloudanix VulnDB

CVE-2026-89697

Critical · 9.1

CVSS

9.1

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux file sharing software can let outsiders change file properties on shared drives without permission, risking data damage or service disruption.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing fh_want_write() call after early fh_verify() in the BOTH_TIME_SET path of nfsd_proc_setattr() allows notify_change() to execute without a mount write reference, bypassing intended write authorization checks on the dentry.

Why it matters to the business

Attackers can remotely alter file attributes on NFS exports without proper authorization, potentially leading to data corruption, denial of service on shared storage, or privilege escalation within mounted filesystems across Linux servers.

How an attack unfolds

An attacker sends a crafted NFS SETATTR request with BOTH_TIME_SET attributes to an exposed nfsd instance; the early fh_verify() path skips the write reference acquisition, allowing notify_change() to succeed and modify attributes that should have been blocked.

How to fix it

Apply the upstream kernel patch that inserts fh_want_write() after the early fh_verify() in nfsd_proc_setattr(); rebuild and deploy the fixed kernel on all NFS servers; restrict NFS exposure to trusted networks until patched.

How to confirm the fix worked

Confirm the presence of the fh_want_write() call in nfsd_proc_setattr() source after the BOTH_TIME_SET fh_verify(); test with a SETATTR request containing BOTH_TIME_SET and verify that write reference checks are enforced.

Typical attack path

  1. Identify exposed NFS server via network scanning
  2. Craft SETATTR RPC with BOTH_TIME_SET flag targeting a valid file handle
  3. Send request to trigger early-verified setattr path
  4. Observe successful attribute modification without write credentials

How to detect it

Review nfsd audit logs and kernel messages for SETATTR operations that succeed without corresponding write reference acquisition; correlate with unexpected mtime/atime changes on exported filesystems.

What your security team should do

  • Prioritize patching all Linux kernels running nfsd within the next 30 days due to high CVSS
  • Temporarily disable NFSv3 SETATTR support or enforce strict export options if patching is delayed
  • Monitor for unusual SETATTR traffic on NFS ports
  • Review and tighten NFS export permissions to least privilege

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

Affected packages

Ecosystem Package Introduced Fixed