CVE-2026-89697

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

State: Published
Severity: 9.1 Critical
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference.

Add the missing fh_want_write() call after the early fh_verify().

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cc265089ce1b176dde963c74b53593446ee7f99a to before 3eec9d791968c177a4a8cda9af5c04f79dae09cbAffected cc265089ce1b176dde963c74b53593446ee7f99a to before 9229d824b938f4fb0ea7a5dddade51735e6fe6f9Affected cc265089ce1b176dde963c74b53593446ee7f99a to before 2150305134889fb2fc25228d35353bd2f6f29500Affected cc265089ce1b176dde963c74b53593446ee7f99a to before d823bf9285cdf4514873b85ab5a888878dd4e8f4Affected cc265089ce1b176dde963c74b53593446ee7f99a to before 15ca3b64a69caa6194bed8f98a20ed90a11c11ddAffected cc265089ce1b176dde963c74b53593446ee7f99a to before 533964d420d385e11b08dd4c56c66ef5dcccaf08Affected cc265089ce1b176dde963c74b53593446ee7f99a to before c4a409b86a92815181a8e9395c6bf1696ad19175Affected cc265089ce1b176dde963c74b53593446ee7f99a to before 4e475be769aa9f7a2c1ce55a2b8592cfccacddccAffected 1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd8Affected 3.18.46 to before 3.19Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

cc265089ce1b176dde963c74b53593446ee7f99a to before 3eec9d791968c177a4a8cda9af5c04f79dae09cbAffected
cc265089ce1b176dde963c74b53593446ee7f99a to before 9229d824b938f4fb0ea7a5dddade51735e6fe6f9Affected
cc265089ce1b176dde963c74b53593446ee7f99a to before 2150305134889fb2fc25228d35353bd2f6f29500Affected
cc265089ce1b176dde963c74b53593446ee7f99a to before d823bf9285cdf4514873b85ab5a888878dd4e8f4Affected
cc265089ce1b176dde963c74b53593446ee7f99a to before 15ca3b64a69caa6194bed8f98a20ed90a11c11ddAffected
cc265089ce1b176dde963c74b53593446ee7f99a to before 533964d420d385e11b08dd4c56c66ef5dcccaf08Affected
cc265089ce1b176dde963c74b53593446ee7f99a to before c4a409b86a92815181a8e9395c6bf1696ad19175Affected
cc265089ce1b176dde963c74b53593446ee7f99a to before 4e475be769aa9f7a2c1ce55a2b8592cfccacddccAffected
1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd8Affected
3.18.46 to before 3.19Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.