Cloudanix VulnDB

CVE-2026-89713

Critical · 9.1

CVSS

9.1

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux NFS server code lets remote users shrink protected append-only files by exploiting a timing gap, potentially destroying data without permission.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in nfsd_setattr allows truncation of append-only files by performing the NFSD_MAY_TRUNC permission check against an unlocked inode size sample; a concurrent append extends the file before inode_lock is acquired, so notify_change later applies ATTR_SIZE without rechecking IS_APPEND.

Why it matters to the business

Attackers can remotely corrupt or destroy data in NFS-exported append-only files, leading to integrity loss, service disruption, and potential compliance violations without authentication.

How an attack unfolds

An unauthenticated NFS client issues a SETATTR requesting a size reduction on an append-only file while another process concurrently appends data; the unlocked size check passes, the race allows the locked truncation to succeed, bypassing the append-only restriction that VFS paths enforce.

How to fix it

Upgrade the Linux kernel to a version containing the fix that moves the truncation permission check after inode_lock acquisition and before notify_change(ATTR_SIZE); apply the patch that splits write-count acquisition from the locked size recheck.

How to confirm the fix worked

Confirm the kernel source contains the updated nfsd_setattr logic that rechecks i_size_read after inode_lock; verify no unlocked i_size comparison precedes the lock for ATTR_SIZE operations on NFS servers.

Typical attack path

  1. Identify an NFS-exported append-only file via unauthenticated mount or getattr
  2. Issue SETATTR with ATTR_SIZE targeting a smaller value while racing an append operation
  3. Trigger concurrent write that extends i_size between the unlocked sample and inode_lock acquisition
  4. nfsd_setattr proceeds to notify_change without re-validating NFSD_MAY_TRUNC against the locked size
  5. File is truncated despite IS_APPEND, completing data corruption

How to detect it

Review NFS server logs and audit trails for SETATTR operations requesting size reduction on files with the append-only attribute; correlate with concurrent write activity and look for notify_change calls that truncate append-only inodes.

What your security team should do

  • Prioritize kernel updates on all NFS servers within 30 days given the high CVSS and network attack vector
  • Restrict NFS exports to trusted clients and enable append-only attributes only where strictly required
  • Monitor for unexpected size reductions on files marked append-only via filesystem auditing
  • Test patched kernels in staging before production rollout to avoid regression in setattr handling

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

Affected packages

Ecosystem Package Introduced Fixed