CVE-2026-89701 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: validate nseconds in TIME_DELEG decode paths
The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms store a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this check but the TIME_DELEG paths do not. A malformed timespec can propagate through notify_change() to disk.
Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's Network File System server implementation contains a critical input validation deficiency within the XDR decoding logic for TIME_DELEG access and modify operations. This vulnerability arises from an inconsistency in how time values are processed during the parsing of NFS protocol messages. Specifically, when handling xdrgen-generated decode paths for TIME_DELEG_ACCESS and TIME_DELEG_MODIFY, the kernel directly assigns a raw uint32_t value representing nanoseconds into the tv_nsec field of a timespec structure without verifying that this value falls within the valid range defined by NSEC_PER_SEC. In contrast, legacy decoding functions such as nfsd4_decode_nfstime4 correctly enforce the constraint that nanoseconds must be less than one second to ensure data integrity and proper time representation.
This lack of boundary checking allows a malicious client or an attacker capable of crafting malformed NFS packets to inject arbitrary large integer values into the kernel's internal time structures. Because the validation is missing, these invalid nanosecond values are not rejected at the input stage but instead propagate through the system's change notification mechanisms via notify_change(). This process ultimately leads to the persistence of corrupted timestamp data on the underlying file system storage. The impact extends beyond simple data corruption; it can lead to filesystem inconsistencies, potential denial of service conditions due to kernel instability or unexpected behavior in time-sensitive operations, and potentially exploitable state issues if other components rely on accurate timestamps for security decisions such as certificate expiration checks or audit log integrity.
From a vulnerability classification perspective, this issue aligns with CWE-20 Improper Input Validation, specifically the failure to perform adequate boundary checks on input parameters before processing. The attack vector involves remote interaction with the NFS server service, which maps to MITRE ATT&CK technique T1498 Network Denial of Service if exploited for disruption or potentially data manipulation techniques depending on the specific exploitation context and subsequent system behavior. The root cause is a regression in code maintenance where new xdrgen-based decoding paths were implemented without inheriting the robust validation logic present in older, legacy code paths.
Mitigation requires immediate patching to apply range checks within both nfs4xdr.c for SETATTR operations and nfsdcallback.c for CB_GETATTR callbacks. System administrators should ensure that their Linux distributions are updated with the latest kernel packages containing this fix. Until patches are applied, network-level controls such as firewalls or intrusion detection systems can be configured to monitor NFS traffic for anomalous packet sizes or unusual time field values, although application-layer validation remains the primary defense against this specific input validation flaw.