Executive brief
The Linux kernel's NFS server (NFSD) contains a time-of-check-time-of-use (TOCTOU) race condition that allows clients to bypass security restrictions on append-only files. An attacker can exploit a timing window to truncate a file marked with the append-only flag, which should normally be prevented. This could allow unauthorized modification of critical files that are supposed to be write-append-only.
Technical details
The vulnerability is a TOCTOU race condition in the nfsd_setattr() function in fs/nfsd/vfs.c. The code checked whether truncation permission (NFSD_MAY_TRUNC) was required based on an unlocked read of the file size, but the actual truncation was performed later under the inode lock by notify_change(). This left a window where a concurrent append operation could extend the file between the permission check and the lock acquisition, causing notify_change() to perform an unintended truncation on an append-only file without the required permission check. The fix separates the write-access acquisition from the truncation permission check and re-checks the permission after acquiring the inode lock and before calling notify_change().
Affected products
- Linux Linux kernel linux-2.6.11.y through linux-7.2.y
Timeline
- 2026-09-11: disclosed: CVE-2026-89713 published
- 2026-05-30: patched: Fix committed upstream by Jeff Layton
- 2026-09-07: patched: Backported to stable kernel branches