Executive brief
The Linux kernel's NFS server has a flaw in how it handles failed write operations during asynchronous file copying. When a write fails, the server incorrectly tells clients the data is durable, causing clients to silently lose data. This affects systems using NFS for file sharing and can result in data loss when copy operations encounter storage errors.
Technical details
The vulnerability exists in the async COPY handling within NFSD (NFS server daemon), specifically in the _nfsd_copy_file_range() function in fs/nfsd/nfs4proc.c. When an asynchronous COPY operation's post-copy writeback (vfs_fsync_range or filemap_check_wb_err) fails, the server fails to rotate the write verifier value. This violates RFC 7862 and RFC 8881's UNSTABLE+COMMIT durability contract: a client receives NFS_UNSTABLE in the CB_OFFLOAD callback and subsequently sends COMMIT, which incorrectly returns the same verifier, causing the client to believe the copy succeeded when the writeback actually failed. The fix adds a call to nfsd_reset_write_verifier() when a durable-storage failure is detected, excluding transient errors (EAGAIN and ESTALE). No authentication is required; the flaw affects NFS server implementations processing COPY requests from any client.
Affected products
- Linux Linux kernel multiple versions (patched in stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89706 published on NVD
- 2026-05-22: patched: Upstream fix committed by Chuck Lever
- 2026-09-07: patched: Fix backported to stable kernel trees