CVE-2026-89706nfsd: Reset write verifier when async COPY writeback fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writeverf at request time and reports it to the client via CB_OFFLOAD after the worker kthread completes. When the post-copy vfs_fsync_range() or filemap_check_wb_err() in _nfsd_copy_file_range() reports an error, the worker correctly leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes wr_stable_how as NFS_UNSTABLE, but the server's write verifier is not rotated. A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with COMMIT to make the copied data durable. With the verifier unchanged, COMMIT returns the same value the client just received via CB_OFFLOAD, and the client concludes the copy is durable -- silently dropping the data whose writeback in fact failed. This violates the UNSTABLE+COMMIT durability contract (RFC 7862 section 15.1, RFC 8881 section 18.32) and matches the bug just fixed in nfsd_vfs_write() and nfsd_commit(). Rotate nn->writeverf at the writeback-failure site. The async COPY worker has no svc_rqst, so commit_reset_write_verifier() is not available here; calling nfsd_reset_write_verifier() directly mirrors the trace-less reset already used by nfsd_file_check_write_error() for the same purpose. Filter out -EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since neither indicates a durable-storage failure.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 817c6eb975798647c4bbbfc9eb288aa413ec7f65 before cc5f7cef0659a27c13dd33edd8e2f79257b095c6; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before 8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before 6b13d26cc21b6320a3c61d5e4cee2ce9a589b181; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before 31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before 591134e059e3456180244a826d6917cdc183140b; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before bf0cd31a9abcb728c17d79b4c2cc533612a8b6af; from eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d before f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/cc5f7cef0659a27c13dd33edd8e2f79257b095c6
- https://git.kernel.org/stable/c/c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7
- https://git.kernel.org/stable/c/8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a
- https://git.kernel.org/stable/c/6b13d26cc21b6320a3c61d5e4cee2ce9a589b181
- https://git.kernel.org/stable/c/31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0
- https://git.kernel.org/stable/c/591134e059e3456180244a826d6917cdc183140b
- https://git.kernel.org/stable/c/bf0cd31a9abcb728c17d79b4c2cc533612a8b6af
- https://git.kernel.org/stable/c/f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.