CVE-2026-89678: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89678 Overview

CVE-2026-89678 is a data-integrity vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd_direct_write(), which mishandles partial-write detection when processing multi-segment NFS write requests. A remote NFS client can trigger conditions where subsequent write segments land at incorrect file offsets, causing silent data corruption on the server. The vulnerability affects Linux kernels that include the nfsd_direct_write() implementation and is fixed in upstream stable commits 250ec14 and fa6590d.

Critical Impact
Remote NFS clients can silently corrupt server-side files when short writes complete between 50% and 99% of a segment, and the server over-reports written byte counts to the client.

Affected Products

Linux kernel builds containing the nfsd_direct_write() implementation
NFS server deployments exposing nfsd to network clients
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89678 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89678

Vulnerability Analysis

The vulnerability lives in nfsd_direct_write(), which iterates through a list of write segments and calls vfs_iocb_iter_write() on each one. After each call, the code attempts to detect a short write so the loop can stop before placing the next segment at an incorrect file offset. The detection logic compares the returned byte count against segments[i].iter.count.

The root problem is that vfs_iocb_iter_write() invokes ->write_iter(), which advances the iterator by the number of bytes written. By the time the check runs, segments[i].iter.count reflects the residual bytes remaining, not the original request length. The comparison host_err < segments[i].iter.count therefore reduces to host_err < original_len - host_err, which is only true when less than half of the segment was written.

Short writes completing between 50% and 99% of a segment slip past the check. The loop then advances to the next segment, but kiocb->ki_pos was only bumped by the short amount. The next segment's payload is written at the wrong file offset, and the aggregated *cnt value returned to the NFS client is over-reported.

Root Cause

The root cause is a stale-value comparison bug. The code reads segments[i].iter.count after the write, at which point the iterator has already been advanced. The fix, applied in commits 250ec14 and fa6590d, snapshots the segment's original byte count before calling vfs_iocb_iter_write() and compares host_err against that snapshot.

Attack Vector

Exploitation requires an NFS client capable of triggering multi-segment direct writes against a vulnerable nfsd server. Any condition on the server-side backing filesystem that causes a short write (resource pressure, quota limits, block-device throttling) can produce the corruption. No authentication beyond standard NFS export permissions is required, and the vulnerability is exposed over the network wherever nfsd is reachable. The result is silent on-disk data corruption and incorrect byte counts returned to clients, without any triggering exploit primitives such as memory corruption or code execution.

See the upstream fix commits Kernel Git Commit 250ec14 and Kernel Git Commit fa6590d for the exact code changes.

Detection Methods for CVE-2026-89678

Indicators of Compromise

Unexpected data corruption within files written by NFS clients performing multi-segment or direct-I/O writes
Client-reported write byte counts that exceed the actual number of bytes persisted on the NFS server
Filesystem consistency errors or application-level checksum mismatches on files served by nfsd

Detection Strategies

Audit running kernel versions on all NFS server hosts and compare against fixed builds referenced in the upstream stable commits
Enable NFS server tracepoints (nfsd:*) and correlate short-write events on the backing filesystem with reported client write completions
Implement application-layer checksums or hash validation on files written through NFS to detect silent corruption

Monitoring Recommendations

Track kernel package versions across the fleet using configuration management and flag hosts still running vulnerable builds
Monitor NFS server logs for I/O errors, quota events, and backing-store pressure that could induce short writes
Alert on filesystem integrity check failures for exports served by nfsd

How to Mitigate CVE-2026-89678

Immediate Actions Required

Apply the upstream kernel patches from commits 250ec14932d5cfe102f68a57892bb566eee7f83e and fa6590dfd16ab55f03b658b079072ace3504825e or upgrade to a distribution kernel that includes them
Prioritize patching on hosts running nfsd and exposing NFS exports over untrusted or shared networks
Validate integrity of critical files written via NFS since the vulnerable kernel was deployed

Patch Information

The fix snapshots the original segment byte count before calling vfs_iocb_iter_write() and uses that snapshot for the short-write comparison. This ensures any short write, regardless of completion percentage, breaks the loop and prevents subsequent segments from being written at incorrect offsets. Patches are available in the mainline and stable kernel trees at Kernel Git Commit 250ec14 and Kernel Git Commit fa6590d.

Workarounds

Restrict NFS exports to trusted networks using firewall rules and NFS exportfs access controls until patched kernels are deployed
Where feasible, disable direct I/O paths on the NFS server or route client writes through buffered I/O to reduce exposure
Reduce conditions that cause short writes on backing storage by increasing quotas, addressing disk pressure, and ensuring adequate free space

bash

# Verify running kernel version and confirm patch inclusion
uname -r

# Restrict NFS access at the host firewall (example: allow only trusted subnet)
iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP

# Review current NFS exports
exportfs -v