CVE-2026-89713

CVE CVE-2026-89713EUVD EUVD-2026-76625Published 2026-09-11T19:46:27.000ZLast changed 2026-09-13T06:33:36.000ZCVSS 9.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 604a3c407026d6162d15300478e63f901e435efc; 982898d7f97a35447403c3fcecc0d96c646ce101; 3ee4f442e5b37a537297b812557b1163f96b5399; 783112f7401ff449d979530209b3f6c2594fdb4e <b778e0e0a16759f22a70579c3cf8d254a40d4a7f; 4.10.2 <4.11; cc4d5dc73841b98d33cdfb9822d70b0aac4beca5; 3.2.89 <3.3; 3.16.44 <3.17; 783112f7401ff449d979530209b3f6c2594fdb4e <d8352da196349182e1afd5a93308256cddc0a97d; patch: 0; patch: 6.12.109; patch: 7.2.4; a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44; 4.9.14 <4.10; 4.11; 4.4.53 <4.5; 783112f7401ff449d979530209b3f6c2594fdb4e <3afa17d93ba8c925f49370c816c6dae5112d8c24; 783112f7401ff449d979530209b3f6c2594fdb4e <44086254479035de42ca3d286ecf25521d4e6325; patch: 6.18.50; patch: 7.3-rc1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.