CVE-2026-89678
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix partial-write detection in nfsd_direct_write
nfsd_direct_write() walks a list of write segments and, after each vfs_iocb_iter_write(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset:
host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
if (host_err < 0) return host_err; *cnt += host_err; if (host_err < segments[i].iter.count)
break; /* partial write */
vfs_iocb_iter_write() runs the iter through ->write_iter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original
request length:
before write_iter: iter.count == original_len after write_iter: iter.count == original_len - host_err
The condition then reduces to host_err < original_len - host_err, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->ki_pos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting *cnt to the NFS client.
Snapshot the segment's byte count before the write and compare host_err against that snapshot so any short write breaks the loop.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel within the nfsd module, specifically affecting the nfsd_direct_write function, represents a critical logic error in how partial writes are detected during NFS server operations. This flaw allows for data corruption and incorrect file offset tracking when handling direct write requests from clients. The core of the issue lies in the sequence of operations performed after invoking vfs_iocb_iter_write to process a segment of write data. The function is designed to iterate through a list of write segments, executing a write operation on each one before checking if the write was complete or partial. If a short write occurs, the loop should terminate immediately to prevent subsequent segments from being written at incorrect file offsets and to ensure accurate byte counts are reported back to the NFS client.
The technical flaw stems from an incorrect reference point used for detecting incomplete writes. After vfs_iocb_iter_write executes, it advances the iterator by the number of bytes successfully written. Consequently, the count field within the segment's iterator no longer holds the original length of the request but rather the residual amount remaining to be written. The existing code checks if host_err is less than segments[i].iter.count. Since iter.count has been decremented by the write operation, this condition effectively compares the number of bytes written against the number of bytes left to write. Mathematically, this translates to checking if host_err is less than original_len minus host_err. This logic only triggers a break when fewer than half of the segment's data was successfully written.
This flawed detection mechanism creates a significant window for exploitation where short writes completing between fifty and ninety-nine percent of the segment size are incorrectly treated as successful full writes. When such a partial write occurs, the loop does not terminate but instead proceeds to process the next segment in the list. Because the file position indicator kiocb->ki_pos is only incremented by the actual number of bytes written rather than the expected segment length, the subsequent segment's payload is placed at an incorrect offset within the target file. This results in data corruption as parts of different write requests overlap or are misaligned on disk. Furthermore, the function over-reports the total count of bytes written to the NFS client by including the unwritten portion of the partial segment, leading to inconsistencies between what the client believes was stored and what is actually present on the server storage.
From a security perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it fails to correctly validate the outcome of an input processing operation against expected constraints. It also relates to CWE-681 Incorrect Conversion between Numeric Types in terms of logic flow and state management errors that lead to unexpected behavior. In the context of the MITRE ATT&CK framework, this could be leveraged for data manipulation or integrity violation attacks if an attacker can control write sizes to trigger these partial write conditions repeatedly. The impact extends beyond simple data corruption; it undermines the reliability of NFS services which are often critical infrastructure components in enterprise environments relying on consistent file system semantics across networked systems.
To mitigate this vulnerability, developers must modify nfsd_direct_write to snapshot the segment's byte count before initiating the write operation. By storing the original length in a temporary variable prior to calling vfs_iocb_iter_write, the subsequent check can accurately compare host_err against this static value rather than the mutated iterator count. This ensures that any short write, regardless of its proportion relative to the total segment size, will correctly trigger the loop termination logic. System administrators should ensure their Linux kernels are updated with patches addressing this specific nfsd fix. Regular auditing of NFS server logs for unexpected file sizes or offset errors can help detect potential exploitation attempts in environments where patching is delayed. Maintaining strict version control and applying kernel updates promptly remains the primary defense against such low-level logic vulnerabilities that compromise data integrity at the storage layer.