CVE-2026-89678

nfsd: fix partial-write detection in nfsd_direct_write

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix partial-write detection in nfsd_direct_write

nfsd_direct_write() walks a list of write segments and, after each
vfs_iocb_iter_write(), tries to detect a short write so the loop can
stop before placing the next segment at a wrong file offset:

host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
if (host_err < 0)
return host_err;
*cnt += host_err;
if (host_err < segments[i].iter.count)
break; /* partial write */

vfs_iocb_iter_write() runs the iter through ->write_iter(), which
advances the iter by the number of bytes written. By the time the
check runs, segments[i].iter.count is the residual, not the original
request length:

before write_iter: iter.count == original_len
after write_iter: iter.count == original_len - host_err

The condition then reduces to host_err < original_len - host_err, so
the break fires only when less than half of the segment was written.
Any short write completing between 50% and 99% of the segment slips
through; the loop advances to the next segment with kiocb->ki_pos
only bumped by the short amount, writing the next segment's payload
at the wrong offset and over-reporting *cnt to the NFS client.

Snapshot the segment's byte count before the write and compare
host_err against that snapshot so any short write breaks the loop.

Analysis

Technical impact

The Linux kernel NFS daemon contains a logic error in nfsd_direct_write where the loop that processes NFS write segments fails to properly detect partial writes that complete between 50% and 99%. The loop compares the bytes written against a residual count that has already been reduced, causing the condition to trigger only when less than half of the segment is written. As a result, subsequent segments are written at a file offset that is off by the short write amount, overwriting or corrupting data. The vulnerability manifests only when a malicious NFS client issues specially crafted write requests that advance the offset incorrectly. Based on the description, it is inferred that an attacker needs the ability to send NFS write requests to the server and must have write access to a file exposed via NFS, but no higher privileges.

Affected Systems

All Linux kernels that contain the unpatched nfsd_direct_write path are vulnerable, regardless of distribution. The advisory does not enumerate specific kernel releases, so any kernel snapshot prior to the commit appears in the Linux kernel repository should be considered at risk. This includes stock kernels shipped in many popular Linux distributions as well as custom kernels that have not been updated.

Risk and Exploitability

The CVSS score of 7.5 reflects high severity, whereas the EPSS score of less than 1% indicates a low probability of widespread exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves remote NFS write access, because the bug manifests when an NFS client sends write traffic that triggers the logic error. Inference from the description suggests that the attacker would need to have write access to an NFS‑exported file, but no other privileged context beyond NFS write access. If the logic error is triggered, file contents can be corrupted or overwritten, potentially leading to data loss or integrity violations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`06c5c97293e3fca99ce15da157068edf45a7c6e4`	affected	< fa6590dfd16ab55f03b658b079072ace3504825e
`06c5c97293e3fca99ce15da157068edf45a7c6e4`	affected	< 250ec14932d5cfe102f68a57892bb566eee7f83e

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[06c5c97293e3fca99ce15da157068edf45a7c6e4,fa6590dfd16ab55f03b658b079072ace3504825e)`	affected	code_commit	—
`[06c5c97293e3fca99ce15da157068edf45a7c6e4,250ec14932d5cfe102f68a57892bb566eee7f83e)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.19`	affected	generic	—
`[0,6.19)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Linux kernel patch (commit 250ec14932d5cfe102f68a57892bb566eee7f83e) to fix the logic error tied to CWE‑823.
Restrict NFS traffic to trusted hosts or implement firewall rules limiting NFS write access, thereby reducing exposure to the CWE‑823 condition.
If an immediate kernel update is not possible, temporarily unmount NFS shares that may be used by untrusted clients until the patch can be applied.
Deploy file‑integrity monitoring for NFS‑exported files to detect unexpected changes caused by the CWE‑823 issue.

Generated by OpenCVE AI on September 15, 2026 at 20:22 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.380% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e
https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e
https://nvd.nist.gov/vuln/detail/CVE-2026-89678
https://www.cve.org/CVERecord?id=CVE-2026-89678

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-823
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89678 https://www.cve.org/CVERecord?id=CVE-2026-89678
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list of write segments and, after each vfs_iocb_iter_write(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset: host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter); if (host_err < 0) return host_err; cnt += host_err; if (host_err < segments[i].iter.count) break; / partial write / vfs_iocb_iter_write() runs the iter through ->write_iter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length: before write_iter: iter.count == original_len after write_iter: iter.count == original_len - host_err The condition then reduces to host_err < original_len - host_err, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->ki_pos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting cnt to the NFS client. Snapshot the segment's byte count before the write and compare host_err against that snapshot so any short write breaks the loop.
Title		nfsd: fix partial-write detection in nfsd_direct_write
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e