Cloudanix VulnDB

CVE-2026-89701

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux file-sharing service could let a remote user send bad timing information that ends up stored on the server's disk.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Improper input validation in nfsd TIME_DELEG decode paths allows a raw uint32_t nseconds value >= NSEC_PER_SEC to be written directly into tv_nsec of a timespec without sanitization; the malformed structure then flows through notify_change() into filesystem metadata updates.

Why it matters to the business

NFS servers may accept and persist invalid timestamps on files, risking metadata corruption, failed synchronization, or inconsistent behavior for clients relying on accurate modification/access times; low EPSS and absence from KEV indicate limited real-world exploitation pressure so far.

How an attack unfolds

An attacker sends a crafted NFSv4 SETATTR or CB_GETATTR containing TIME_DELEG_ACCESS/MODIFY with nseconds outside the valid range; the missing check in the xdrgen-generated decode paths stores the value verbatim, allowing it to reach disk via notify_change().

How to fix it

Apply the upstream kernel commit that adds explicit nseconds < NSEC_PER_SEC range checks in nfs4xdr.c (SETATTR) and nfs4callback.c (CB_GETATTR); rebuild and deploy the patched kernel on all NFS servers.

How to confirm the fix worked

Inspect nfs4xdr.c and nfs4callback.c for the added bounds checks on nseconds; fuzz the TIME_DELEG decode paths with values >= NSEC_PER_SEC and confirm they are rejected before reaching notify_change().

Typical attack path

  1. Craft NFSv4 compound request with TIME_DELEG containing nseconds >= 1000000000
  2. Send request to nfsd SETATTR or trigger CB_GETATTR callback path
  3. Bypass legacy nfstime4 validation that exists in other decode arms
  4. Malformed timespec propagates to VFS notify_change()
  5. Invalid timestamp written to on-disk inode metadata

How to detect it

Search kernel logs and audit trails for nfsd entries referencing TIME_DELEG or malformed timespec values; inspect network captures for NFSv4 SETATTR/CB_GETATTR operations carrying nseconds outside 0..999999999.

What your security team should do

  • Patch all exposed nfsd instances with the range-check fix as soon as a distribution kernel update is available
  • Restrict NFSv4 access to trusted clients via firewall or export options until patches are deployed
  • Monitor nfsd logs and kernel timestamps for anomalous nsec values in future audits

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms store a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this check but the TIME_DELEG paths do not. A malformed timespec can propagate through notify_change() to disk. Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path).

Affected packages

Ecosystem Package Introduced Fixed