CVE-2026-89678

The Linux kernel's NFS server (nfsd) fails to detect partial writes in nfsd_direct_write(): the short-write check compares the bytes written against an iterator count that write_iter() has already reduced to the residual bytes, so a genuine short write is never caught. When a direct write completes short (for example due to an I/O error, interrupted write, or size/resource limit), the loop continues and places the next write segment's data at the wrong file offset, while the server also reports an inflated write count back to the NFS client. An attacker able to send write requests to an affected nfsd export can therefore cause silent data corruption on server-side files, with clients believing their writes fully succeeded; the issue is rated CVSS 7.5 (high, integrity-only) with network access, no privileges, and no user interaction required. Affected systems are Linux machines running the kernel nfsd server with the vulnerable direct-write code, though the record does not enumerate specific kernel version numbers. No public proof of concept and no known in-the-wild exploitation exist, and the flaw is not on the CISA KEV list.

What to do: Upgrade to a kernel build containing the nfsd_direct_write fix as soon as your distribution ships it and reload/reboot the NFS server so the patched kernel is active. In the meantime, restrict write access on NFS exports to trusted clients and keep TCP/2049 off untrusted networks, since any client able to issue writes can trigger the bug. Because corruption is silent and clients are told writes succeeded, audit NFS-written files for data at incorrect offsets, particularly after short-write conditions such as full disks, I/O errors, or interrupted writes.