Executive brief
The Linux kernel's NFS server (nfsd) component accepts delegated timestamp values from NFS clients without properly validating the nanosecond component of the timestamp. An attacker could send a malformed timestamp with an out-of-range nanosecond value, which could propagate through the file system and potentially cause data corruption or other unexpected behavior on exported file systems.
Technical details
The vulnerability is an input validation flaw in the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY XDR decoding paths in the Linux kernel's nfsd implementation. These paths accept a raw uint32_t nanosecond value without enforcing the constraint that nanoseconds must be less than NSEC_PER_SEC (1,000,000,000). A malformed timespec with an out-of-range nanosecond value can propagate through notify_change() to disk via either the SETATTR (nfs4xdr.c) or CB_GETATTR (nfs4callback.c) paths. The legacy nfsd4_decode_nfstime4 function already contains the necessary range check, but the newer TIME_DELEG code paths did not. The fix adds explicit validation to reject timestamps with nseconds >= NSEC_PER_SEC.
Affected products
- Linux Linux kernel 2.6.11 through 7.1 (all stable branches with nfsd TIME_DELEG support)
Timeline
- 2026-09-11: disclosed: CVE-2026-89701 published
- 2026-08-10: patched: Fix merged by Chuck Lever
- 2026-09-07: patched: Backported to stable kernels