CVE-2026-89665 Overview
CVE-2026-89665 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw resides in the NFSv2 sattr decoder function svcxdr_decode_sattr(), which converts wire useconds to nanoseconds. On 32-bit (ILP32) platforms, multiplying a u32 useconds value by NSEC_PER_USEC (1000) can wrap the result in unsigned long arithmetic. An out-of-range value such as 4294968 wraps to tv_nsec == 704, bypassing later range checks. The corruption occurs during XDR decode before any proc function inspects the value. Remote NFSv2 clients can trigger the flaw through SETATTR or CREATE operations.
Critical Impact
Remote unauthenticated NFSv2 clients can inject corrupted timestamp values into the server file system, bypassing kernel range checks and causing integrity issues on hosted files.
Affected Products
- Linux kernel nfsd (NFSv2 server implementation)
- 32-bit (ILP32) Linux systems exporting NFSv2 shares
- Multiple stable kernel branches referenced in upstream fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89665 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89665
Vulnerability Analysis
The vulnerability is a numeric truncation and integer wraparound issue in the NFSv2 XDR decoder. The svcxdr_decode_sattr() function decodes client-supplied sattr structures for SETATTR and CREATE RPC calls. Timestamp useconds arrive as a u32 on the wire and are converted to nanoseconds with the expression iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC.
On 32-bit platforms, the product is evaluated in unsigned long width (32 bits). Any useconds value greater than approximately 4,294,967 causes the multiplication to wrap, yielding a small in-range tv_nsec value. Because the corruption occurs during decode, downstream sanity checks against the nanosecond range see a valid value and accept it. NFSv2 defines no NFSERR_INVAL, so the check cannot be deferred to the proc function as it is for NFSv3 and NFSv4.
A secondary logic bug affected the Sun convention value of 1,000,000 useconds, which signals "use current server time". The decoder only cleared ATTR_ATIME_SET|ATTR_MTIME_SET in the mtime block. A client passing 1,000,000 only in the atime field caused an out-of-range tv_nsec of 10^9 to reach the file system with ATTR_ATIME_SET still set.
Root Cause
The root cause is missing input validation combined with integer truncation on ILP32 architectures. The multiplication tmp2 * NSEC_PER_USEC is not promoted to a 64-bit type before the range check. Additionally, the Sun convention handling was asymmetric between the atime and mtime blocks.
Attack Vector
A remote NFSv2 client sends a crafted SETATTR or CREATE RPC with useconds values greater than 1,000,000 in the atime or mtime fields. No authentication is required beyond normal NFS export access. The attacker submits the malformed RPC over the network and the server accepts corrupted timestamps into on-disk metadata. The fix guards the raw useconds before multiplication, rejecting values greater than 1,000,000 with a GARBAGE_ARGS RPC reply, while preserving the Sun convention value of 1,000,000 in both atime and mtime blocks.
No public proof-of-concept code is available. See the upstream commits including Kernel Git Commit 09a79d9 and Kernel Git Commit 1db456ff for the corrective patches.
Detection Methods for CVE-2026-89665
Indicators of Compromise
- Unexpected RPC GARBAGE_ARGS replies from nfsd after applying the patch, indicating clients or attackers sending out-of-range useconds values.
- File timestamps on NFSv2-exported volumes with anomalous tv_nsec values, particularly small values such as 704 that do not match expected client behavior.
- Repeated SETATTR or CREATE requests from a single NFSv2 client with malformed sattr structures.
Detection Strategies
- Enable NFS server audit logging and inspect SETATTR and CREATE call arguments for useconds fields exceeding 1,000,000.
- Correlate NFS RPC traffic captures with file system metadata changes to identify malformed decode attempts.
- Monitor for hosts still serving NFSv2, which has been deprecated in favor of NFSv3 and NFSv4.
Monitoring Recommendations
- Track kernel version and patch level across the fleet to identify unpatched NFS servers, particularly on 32-bit architectures.
- Alert on new NFSv2 mount requests, which should be rare in modern environments.
- Capture packet traces at NFS server boundaries and inspect the sattr field values for anomalies.
How to Mitigate CVE-2026-89665
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry to all affected servers.
- Disable NFSv2 on all NFS servers unless a specific legacy client requires it, since NFSv3 and NFSv4 already contained equivalent range checks in their proc functions.
- Prioritize patching on 32-bit (ILP32) Linux systems, where the integer wraparound occurs.
Patch Information
The fix guards the raw useconds value before the multiplication, rejecting values greater than 1,000,000 and returning an RPC GARBAGE_ARGS reply. The Sun convention value of 1,000,000 is preserved and now handled symmetrically in both the atime and mtime blocks. Patched commits include Kernel Git Commit 11954839, Kernel Git Commit 26709c8f, Kernel Git Commit 5296a244, Kernel Git Commit a937dd1a, Kernel Git Commit ad02d095, and Kernel Git Commit cdc3299f.
Workarounds
- Disable NFSv2 support in /etc/nfs.conf or via rpc.nfsd invocation flags, restricting exports to NFSv3 and NFSv4 only.
- Restrict NFS server access with firewall rules limiting connections to trusted client subnets.
- Migrate legacy clients still requiring NFSv2 to NFSv3 or NFSv4, which are not affected by this specific decoder flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.