Executive brief
The Linux kernel's NFS server (nfsd) handles file copying operations that clients use to duplicate files on the server. A race condition in the asynchronous COPY implementation can cause the NFS server to incorrectly report that data was safely written to disk when it actually failed, leading to silent data loss—clients believe their copied files are persisted when they are not.
Technical details
The vulnerability exists in the _nfsd_copy_file_range() function in fs/nfsd/nfs4proc.c, which implements the NFSv4 COPY operation. The function samples a writeback error cursor (dst->f_wb_err) after the copy loop completes to detect I/O failures during fsync. However, because the nfsd_file cache reuses a single struct file across concurrent requests targeting the same inode, a concurrent COMMIT or stable WRITE on the same destination file can advance dst->f_wb_err before the COPY worker samples it. If the error cursor advances between when an error appears in the mapping and when the worker samples it, errseq_check() will see no error (cur == since) and incorrectly set NFSD4_COPY_F_COMMITTED. The server then reports FILE_SYNC4 stability to the client, who treats the data as durable, but the writeback actually failed. The fix moves the cursor sampling to the start of the function so it reflects pre-COPY state and catches any errors occurring during the operation regardless of which thread observes them first. No authentication or network preconditions are required; the race occurs between in-kernel kernel threads.
Affected products
- Linux Linux kernel 5.15 and later (affected by change 555dbf1a9aac, patched in 6.1+, 6.10+, and stable series)
Timeline
- 2026-09-11: disclosed: CVE-2026-89704 published
- 2026-08-03: patched: Fix committed upstream by Chuck Lever
- 2026-09-14: patched: Fix included in stable release by Greg Kroah-Hartman