CVE-2026-89697 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference.
Add the missing fh_want_write() call after the early fh_verify().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's Network File System daemon, known as nfsd, contains a logic flaw in its handling of file attribute updates during SETATTR operations. Specifically, within the nfsd_proc_setattr function, there is a code path designated for updating both modification and access times simultaneously, referred to as BOTH_TIME_SET. In this scenario, the kernel performs an early verification of the file handle using fh_verify() to allow setattr_prepare() to inspect the associated dentry before proceeding with further checks. This architectural decision was intended to optimize or facilitate specific attribute update scenarios but inadvertently introduced a security gap regarding write permission enforcement.
The core technical flaw arises because this early execution path causes nfsd_setattr() to bypass the critical fh_want_write() call. The fh_wont_write function is responsible for acquiring and validating mount-level write references, which are essential prerequisites for modifying file data or attributes on most filesystems supported by NFS. By skipping this step due to the early verification logic, the subsequent notify_change() operation proceeds without holding a valid write reference from the underlying mount point. This represents a failure in access control enforcement where the system allows an action that requires elevated privileges without properly verifying those privileges at the correct stage of execution.
From a security perspective, this vulnerability falls under CWE-20 Improper Input Validation and potentially CWE-732 Incorrect Permission Assignment for Critical Resource if it leads to unauthorized modifications. In terms of MITRE ATT&CK mapping, this behavior aligns with T1548 Abuse Elevation Control Mechanism or more broadly with privilege escalation techniques where an attacker might exploit the lack of proper write reference checks to modify file attributes on files they do not have permission to alter. While SETATTR operations are generally restricted by standard Unix permissions, the bypassing of mount-level write references could potentially allow attackers to manipulate timestamps or other metadata in ways that violate intended security policies, especially if combined with other vulnerabilities or misconfigurations.
The operational impact of this flaw is primarily related to integrity and access control violations. An authenticated user who has permission to perform SETATTR operations on a file might be able to execute these changes without the system correctly enforcing write permissions at the mount level. This could lead to unauthorized modifications, bypassing security controls that rely on proper reference counting for write operations. In severe cases, if this flaw interacts with other kernel mechanisms or specific filesystem implementations, it could contribute to broader stability issues or information disclosure, though the primary risk is the circumvention of intended access restrictions.
To mitigate this vulnerability, the Linux community has implemented a fix by adding the missing fh_want_write() call after the early fh_verify() in the nfsd_proc_setattr function. This ensures that even when file handle verification occurs early for attribute preparation, the necessary write references are still acquired and validated before any changes are applied to the filesystem metadata. Administrators should ensure their systems are updated with patches containing this fix. Regularly applying kernel updates is crucial as it addresses such logic errors in core subsystems like NFS server implementation. Additionally, monitoring logs for unusual SETATTR activity can help detect potential exploitation attempts while patching efforts are underway.