Executive brief
The Linux kernel's NFS server component contains a flaw in detecting when NFS write operations complete only partially. Due to incorrect loop logic, write requests that complete between 50–99% of their intended size are not properly detected, causing the NFS server to write subsequent segments at wrong file offsets and misreport byte counts to clients. This can lead to data corruption on NFS-shared files and operational issues for systems relying on NFS storage.
Technical details
The vulnerability exists in the nfsd_direct_write() function in fs/nfsd/vfs.c. The code attempts to detect short writes by comparing the number of bytes written (host_err) against segments[i].iter.count. However, vfs_iocb_iter_write() advances the iterator, so by the time the check executes, segments[i].iter.count contains the residual (remaining) count, not the original requested length. This causes the condition host_err < segments[i].iter.count to reduce to host_err < original_len - host_err, firing the break only when less than 50% of the segment was written. Any short write between 50–99% completion bypasses the check, allowing the loop to continue with kiocb->ki_pos advanced by only the partial amount, placing the next segment's payload at an incorrect file offset and over-reporting the byte count to the NFS client. The fix snapshots the segment byte count before the write via iov_iter_count() and compares host_err against that snapshot value.
Affected products
- Linux Linux kernel multiple versions (introduced in commit 06c5c97293e3, affecting 4.x, 5.x, 6.x and later)
Timeline
- 2026-09-11: disclosed: CVE-2026-89678 published
- 2026-05-30: patched: Upstream patch committed by Chris Mason (commit 250ec14932d5cfe102f68a57892bb566eee7f83e)
- 2026-09-07: patched: Stable kernel backport by Greg Kroah-Hartman (commit fa6590dfd16ab55f03b658b079072ace3504825e)