Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could lead to silent data loss. When the server encounters certain storage errors during background write operations, it fails to notify the client that the data was not successfully saved. This causes the client to incorrectly assume the data is safe on disk, potentially leading to permanent data corruption or loss without any warning to the user or system administrator.
Technical details
A flaw exists in the Linux kernel's NFSD implementation where nfsd_vfs_write() and nfsd_commit() call filemap_check_wb_err() to detect deferred writeback errors but fail to invoke commit_reset_write_verifier() upon failure. This omission prevents the server from rotating its write verifier (nn->writeverf). Consequently, NFS clients holding UNSTABLE write data will receive an unchanged verifier during a COMMIT operation, leading them to incorrectly conclude that their data is durable on storage. This behavior violates the durability contracts specified in RFC 1813 and RFC 8881. The fix involves adding explicit calls to commit_reset_write_verifier() in the affected error paths to ensure clients are properly notified of write failures.
Affected products
- Linux Linux Kernel 5.10.124 to 5.11, 5.15.49 to 5.16, 5.17 to 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory