CVE-2026-53393 Overview
CVE-2026-53393 affects the Linux kernel's NFS server (nfsd) subsystem. The functions nfsd_vfs_write() and nfsd_commit() call filemap_check_wb_err() to detect deferred writeback errors but fail to rotate the server's write verifier (nn->writeverf) when the check fails. Clients holding UNSTABLE write data will issue a COMMIT, receive the unchanged verifier, and incorrectly conclude their data is durable. This behavior silently drops data that failed writeback and violates the UNSTABLE+COMMIT durability contract defined in RFC 1813 §3.3.7 and RFC 8881 §18.32.
Critical Impact
NFS clients can experience silent data loss because the server reports successful COMMIT operations for writes that failed durable storage, breaking the NFSv3 and NFSv4 write durability guarantees.
Affected Products
- Linux kernel nfsd subsystem across multiple stable branches referenced in the fix commits
- Systems exporting NFS shares using the in-kernel NFS server
- NFSv3 and NFSv4 clients relying on UNSTABLE writes followed by COMMIT for durability
Discovery Timeline
- 2026-07-19 - CVE-2026-53393 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-53393
Vulnerability Analysis
The NFS protocol allows clients to send UNSTABLE writes that the server may hold in memory before persisting them. Clients later issue a COMMIT request and compare the returned write verifier against the one received during the original write. If the verifiers match, the client assumes the data reached stable storage. If they differ, the client replays the writes.
In the affected code paths, nfsd_vfs_write() and nfsd_commit() invoke filemap_check_wb_err() to surface deferred writeback errors reported by the underlying filesystem. When this check returns an error, both functions return the error to the caller without calling commit_reset_write_verifier(). Every other durable-storage-failure path in these functions rotates the verifier before returning, so this omission breaks a documented invariant.
Root Cause
The root cause is a missing verifier-rotation call at two filemap_check_wb_err() error sites within fs/nfsd/vfs.c. The helper commit_reset_write_verifier() already internally filters -EAGAIN and -ESTALE, so the fix adds unconditional calls at both error sites. Without this rotation, the server continues advertising the same verifier value even after acknowledging a writeback failure, causing the COMMIT protocol logic to signal a false success to clients.
Attack Vector
The issue is a data-integrity defect rather than a code-execution vulnerability. Triggering requires a filesystem or storage backend beneath the NFS export to report a deferred writeback error, such as an I/O error on the underlying block device, a full or degraded storage pool, or a remote backing store failure. When this occurs while clients are performing UNSTABLE writes, the server's COMMIT response falsely confirms durability. Clients then discard their unstable write cache, resulting in silent data loss. The vulnerability manifests through normal NFS write and commit operations and does not require attacker-controlled input. Refer to the upstream fix commits for the exact patch context.
Detection Methods for CVE-2026-53393
Indicators of Compromise
- Kernel log entries from the storage stack indicating writeback errors (writeback error, EIO, filesystem-level I/O errors) on volumes backing NFS exports
- Application-level data inconsistency reports from NFS clients following storage incidents on the server
- Unexpected file truncation, missing writes, or checksum mismatches detected after server-side storage recovery events
Detection Strategies
- Correlate NFS server COMMIT responses with underlying block-layer or filesystem error events in dmesg and /var/log/messages
- Monitor for kernel versions predating the fix commits referenced in the Kernel Git Commit 4367af and related patches
- Audit exported filesystems for backing storage that can produce deferred writeback errors under load or hardware failure
Monitoring Recommendations
- Enable and centralize kernel log collection from all NFS servers, capturing block-layer and filesystem error signals
- Track NFS server error counters via /proc/net/rpc/nfsd and correlate with client-reported data anomalies
- Alert on the coincidence of writeback errors with continued client COMMIT success, which indicates the affected pattern
How to Mitigate CVE-2026-53393
Immediate Actions Required
- Inventory Linux systems running the in-kernel NFS server and identify kernels missing the upstream fix
- Apply vendor kernel updates that incorporate the patches referenced by the stable kernel commits below
- Prioritize patching NFS servers exporting data on storage backends prone to deferred writeback errors
Patch Information
The fix adds commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites in nfsd_vfs_write() and nfsd_commit(). Stable kernel patches are available at Kernel Git Commit 1dd664b, Kernel Git Commit 2090b0, Kernel Git Commit 4367af, Kernel Git Commit 43b65d, Kernel Git Commit 666e83, Kernel Git Commit b027cc, Kernel Git Commit b8e589, and Kernel Git Commit bc2bac. Apply the distribution package that pulls in the corresponding stable release.
Workarounds
- Configure NFS clients to use synchronous writes (sync mount option) so writes bypass the UNSTABLE+COMMIT durability path
- Export NFS shares with the sync export option to force server-side synchronous writes until the kernel is patched
- Ensure backing storage is healthy and monitor for I/O errors that could trigger the affected code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
