Executive brief
The Linux kernel's NFS server (nfsd) has a flaw in how it handles file attribute changes (SETATTR operations). When processing certain timestamp modifications, the code skips a critical check that ensures the filesystem is mounted with write permissions. This can allow unauthorized file modifications without proper mount write protection, potentially compromising data integrity and filesystem consistency on NFS-exported systems.
Technical details
The vulnerability is a missing function call in the NFS server's SETATTR handler in nfsd_proc_setattr(). The BOTH_TIME_SET code path calls fh_verify() early to validate file handles before setattr_prepare() inspects the dentry, but this early verification causes the normal code flow to skip the critical fh_want_write() call. As a result, notify_change() executes without acquiring a mount write reference, allowing file attribute modifications without proper mount write protection. The fix adds an explicit fh_want_write() call after the early fh_verify(). The vulnerability affects multiple Linux kernel versions and was introduced by commit cc265089ce1b.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (multiple stable branches affected)
Timeline
- 2026-09-11: disclosed: Advisory published
- 2026-06-11: patched: Fix committed upstream by Jeff Layton
- 2026-09-07: patched: Fix merged into stable branch linux-6.1.y
- 2026-09-14: patched: Fix merged into additional stable branches