CVE-2026-89706

Status: UPDATED  |  Advisory ID: CVE-2026-89706

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to

the client via CB_OFFLOAD after the worker kthread completes. When

the post-copy vfs_fsync_range() or filemap_check_wb_err() in

_nfsd_copy_file_range() reports an error, the worker correctly

leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes

wr_stable_how as NFS_UNSTABLE, but the server's write verifier is

not rotated.

A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with

COMMIT to make the copied data durable. With the verifier

unchanged, COMMIT returns the same value the client just received

via CB_OFFLOAD, and the client concludes the copy is durable --

silently dropping the data whose writeback in fact failed. This

violates the UNSTABLE+COMMIT durability contract (RFC 7862 section

15.1, RFC 8881 section 18.32) and matches the bug just fixed in

nfsd_vfs_write() and nfsd_commit().

Rotate nn->writeverf at the writeback-failure site. The async COPY

worker has no svc_rqst, so commit_reset_write_verifier() is not

available here; calling nfsd_reset_write_verifier() directly

mirrors the trace-less reset already used by

nfsd_file_check_write_error() for the same purpose. Filter out

-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since

neither indicates a durable-storage failure. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References