CVE-2026-89697

The Linux kernel's NFS server (nfsd) contains a flaw in nfsd_proc_setattr(): when an NFS client's SETATTR request sets both access and modification times (the BOTH_TIME_SET branch), an early fh_verify() call causes nfsd_setattr() to skip acquiring the mount write reference via fh_want_write(). As a result, notify_change() executes file attribute changes without write access to the mount, which can allow timestamp/attribute changes that should have been denied on write-protected or read-only exports and can destabilize the kernel (warnings, crashes), impacting integrity and availability. An attacker needs only the ability to send NFS requests to an affected server, per the network/low-complexity/no-privileges CVSS vector. Any host running an affected kernel with the kernel NFS daemon serving filesystems is exposed. No public proof of concept is known and the flaw is not on the CISA KEV list.

What to do: Patch to a kernel release or stable backport that includes the nfsd fix adding fh_want_write() after the early fh_verify() in nfsd_proc_setattr(); verify with your distro which kernel packages carry the fix. Until patched, firewall port 2049 and restrict NFS exports (exports lists, fsid/ro options) so only trusted clients can reach the service. Review logs (dmesg/syslog) for WARN_ON or splats from notify_change()/mnt_want_write paths as evidence of triggering attempts.