CVE-2026-89697nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from cc265089ce1b176dde963c74b53593446ee7f99a before 3eec9d791968c177a4a8cda9af5c04f79dae09cb; from cc265089ce1b176dde963c74b53593446ee7f99a before 9229d824b938f4fb0ea7a5dddade51735e6fe6f9; from cc265089ce1b176dde963c74b53593446ee7f99a before 2150305134889fb2fc25228d35353bd2f6f29500; from cc265089ce1b176dde963c74b53593446ee7f99a before d823bf9285cdf4514873b85ab5a888878dd4e8f4; from cc265089ce1b176dde963c74b53593446ee7f99a before 15ca3b64a69caa6194bed8f98a20ed90a11c11dd; from cc265089ce1b176dde963c74b53593446ee7f99a before 533964d420d385e11b08dd4c56c66ef5dcccaf08; from cc265089ce1b176dde963c74b53593446ee7f99a before c4a409b86a92815181a8e9395c6bf1696ad19175; from cc265089ce1b176dde963c74b53593446ee7f99a before 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb
- https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9
- https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500
- https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4
- https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd
- https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08
- https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175
- https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.