CVE-2026-89704 - Vulnerability Details

- nfsd: sample writeback error cursor before async COPY loop

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback errors
via filemap_check_wb_err() once vfs_fsync_range() returns.
Because the nfsd_file cache reuses a single struct file
across requests targeting the same inode, a concurrent
COMMIT or stable WRITE on dst advances dst->f_wb_err to the
current mapping->wb_err via file_check_and_advance_wb_err()
during its own vfs_fsync_range(). If that advancement lands
between the writeback error appearing in mapping->wb_err
and the COPY worker sampling "since", the worker captures
the already-advanced cursor, errseq_check() sees cur ==
since and returns zero, and NFSD4_COPY_F_COMMITTED is set
even though writeback failed. CB_OFFLOAD then encodes
wr_stable_how = FILE_SYNC4, the client treats the copied
data as durable, and the failure becomes silent data loss.

Sample since once at the start of the function. The cursor
then reflects state in effect before this COPY issues any
writes, and filemap_check_wb_err() detects any error that
occurs during the copy regardless of which thread first
observes it. This matches the pattern used by
nfsd_vfs_write() and nfsd4_clone_file_range().

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel’s NFS server code, specifically in the nfsd_copy_file_range function, causes the writeback error cursor to be sampled after a concurrent commit or write operation. This results in the kernel incorrectly reporting a successful copy operation even when a write loss occurs, leading to silent data loss.

Affected Systems

The flaw copy operation without the patch. No specific kernel versions are listed, so all distributions shipping a vulnerable kernel need to be considered.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a concurrent NFS client initiating copy_file_range on a shared inode while a commit or write occurs, creating the race window needed for the flaw to manifest. Exploitation requires the ability to perform these operations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f14816f2f928c560d28ba344af689f56efcd6f55`	affected	< 435e4246c7dfff2fbd76dfdbf91975d5d9f788c9
`3145fe0ebb16e1715ad541a301bc6675c8375fcd`	affected	< 9f539a1c0791f907eb4e6d04b43178d9962e2def
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 4728504c021656128a07f4693af80ed4a5fcc863
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 322422d66d1a04434a0dcc0c9d3a4c4b3f225117
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 52b2db7a72e19ac2686fa4b2a52406661e7bf9e2
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 8277d4a11ae2cb5495842be558fd946032c24363
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< a1cbafe756cd5e6ab0e099062f37da7a5b081169
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 20a67a7d18221af736f124770c2c5e859b479046
`5.10.124`	affected	< 5.10.270
`5.15.49`	affected	< 5.15.221

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,52b2db7a72e19ac2686fa4b2a52406661e7bf9e2)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,8277d4a11ae2cb5495842be558fd946032c24363)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,a1cbafe756cd5e6ab0e099062f37da7a5b081169)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,20a67a7d18221af736f124770c2c5e859b479046)`	affected	code_commit	—
`f14816f2f928c560d28ba344af689f56efcd6f55`	affected	code_commit	—
`3145fe0ebb16e1715ad541a301bc6675c8375fcd`	affected	code_commit	—
`[5.10.124,5.11)`	affected	semver	—
`[5.15.49,5.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the CVE-2026-89704 fix.
If a kernel upgrade is not immediately possible, consider disabling or limiting use of NFS copy_range operations, or mount NFS shares with the "sync" option to reduce concurrent writeback opportunities.
Implement file integrity verification (e.g., checksums or hash comparison) after NFS copy operations to detect silent data loss until a patch can be applied.

Generated by OpenCVE AI on September 15, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00549.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/20a67a7d18221af736f124770c2c5e859b479046
https://git.kernel.org/stable/c/322422d66d1a04434a0dcc0c9d3a4c4b3f225117
https://git.kernel.org/stable/c/435e4246c7dfff2fbd76dfdbf91975d5d9f788c9
https://git.kernel.org/stable/c/4728504c021656128a07f4693af80ed4a5fcc863
https://git.kernel.org/stable/c/52b2db7a72e19ac2686fa4b2a52406661e7bf9e2
https://git.kernel.org/stable/c/8277d4a11ae2cb5495842be558fd946032c24363
https://git.kernel.org/stable/c/9f539a1c0791f907eb4e6d04b43178d9962e2def
https://git.kernel.org/stable/c/a1cbafe756cd5e6ab0e099062f37da7a5b081169
https://nvd.nist.gov/vuln/detail/CVE-2026-89704
https://www.cve.org/CVERecord?id=CVE-2026-89704

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/322422d66d1a04434a0dcc0c9d3a4c4b3f225117 https://git.kernel.org/stable/c/435e4246c7dfff2fbd76dfdbf91975d5d9f788c9 https://git.kernel.org/stable/c/4728504c021656128a07f4693af80ed4a5fcc863 https://git.kernel.org/stable/c/9f539a1c0791f907eb4e6d04b43178d9962e2def

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89704 https://www.cve.org/CVERecord?id=CVE-2026-89704
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() samples dst->f_wb_err into "since" after the copy loop, then uses it to detect writeback errors via filemap_check_wb_err() once vfs_fsync_range() returns. Because the nfsd_file cache reuses a single struct file across requests targeting the same inode, a concurrent COMMIT or stable WRITE on dst advances dst->f_wb_err to the current mapping->wb_err via file_check_and_advance_wb_err() during its own vfs_fsync_range(). If that advancement lands between the writeback error appearing in mapping->wb_err and the COPY worker sampling "since", the worker captures the already-advanced cursor, errseq_check() sees cur == since and returns zero, and NFSD4_COPY_F_COMMITTED is set even though writeback failed. CB_OFFLOAD then encodes wr_stable_how = FILE_SYNC4, the client treats the copied data as durable, and the failure becomes silent data loss. Sample since once at the start of the function. The cursor then reflects state in effect before this COPY issues any writes, and filemap_check_wb_err() detects any error that occurs during the copy regardless of which thread first observes it. This matches the pattern used by nfsd_vfs_write() and nfsd4_clone_file_range().
Title		nfsd: sample writeback error cursor before async COPY loop
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/20a67a7d18221af736f124770c2c5e859b479046 https://git.kernel.org/stable/c/52b2db7a72e19ac2686fa4b2a52406661e7bf9e2 https://git.kernel.org/stable/c/8277d4a11ae2cb5495842be558fd946032c24363 https://git.kernel.org/stable/c/a1cbafe756cd5e6ab0e099062f37da7a5b081169

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:21.039Z

Updated: 2026-09-14T12:02:06.394Z

Reserved: 2026-09-11T19:38:34.750Z

Link: CVE-2026-89704

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:57.657

Modified: 2026-09-14T13:19:20.367

Link: CVE-2026-89704

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:21Z

Links: CVE-2026-89704 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:45:07Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object