CVE-2026-89697: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89697 Overview

CVE-2026-89697 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw exists in nfsd_proc_setattr(), where the BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This early verification causes nfsd_setattr() to skip fh_want_write(), resulting in notify_change() executing without a mount write reference. Remote NFS clients can trigger the code path over the network without authentication or user interaction.

Critical Impact
Remote attackers can invoke file attribute changes on an NFS export without acquiring the required mount write reference, breaking write-tracking guarantees and threatening integrity and availability of the exported filesystem.

Affected Products

Linux kernel nfsd subsystem (upstream)
Distributions shipping affected stable kernel branches prior to the fix commits
NFS servers exporting filesystems that rely on mount write references for integrity tracking

Discovery Timeline

2026-09-11 - CVE-2026-89697 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89697

Vulnerability Analysis

The defect lives in the NFSv2/v3 server SETATTR path inside nfsd_proc_setattr(). When a client submits a SETATTR request that sets both atime and mtime (the BOTH_TIME_SET branch), the handler invokes fh_verify() early. This early call lets setattr_prepare() inspect the target dentry before the standard nfsd_setattr() flow runs.

Because fh_verify() has already succeeded, the follow-on nfsd_setattr() code path skips its call to fh_want_write(). That helper normally acquires a write reference against the underlying mount, ensuring the filesystem tracks the pending modification. Without it, notify_change() proceeds and mutates on-disk attributes while the mount reports no active writer.

The fix adds the missing fh_want_write() call immediately after the early fh_verify(), restoring the invariant that any notify_change() in the NFSD path holds a mount write reference.

Root Cause

The root cause is a control-flow assumption mismatch between nfsd_proc_setattr() and nfsd_setattr(). The callee assumes it owns the responsibility for fh_want_write() unless the caller already performed early verification. The BOTH_TIME_SET branch performs early fh_verify() but does not compensate by taking the write reference itself, producing a missing-write-reference condition classified as an improper access control / kernel state-management flaw.

Attack Vector

The vulnerability is network reachable. An unauthenticated remote client with the ability to send NFS SETATTR RPCs to an exposed nfsd instance can drive the vulnerable branch by issuing a SETATTR operation that sets both access and modification times on a file within an export. No user interaction is required. Impact is limited to integrity and availability of the served filesystem; confidentiality is not affected.

// Vulnerable control flow (conceptual - see kernel commits for authoritative diff)
// nfsd_proc_setattr():
//   if (BOTH_TIME_SET) {
//       fh_verify(...);              // early verification
//       setattr_prepare(dentry, ...); // dentry inspected
//   }
//   nfsd_setattr(...);               // skips fh_want_write()
//                                    // -> notify_change() runs without
//                                    //    a mount write reference

See the authoritative patches: Kernel Commit 15ca3b64 and Kernel Commit d823bf92.

Detection Methods for CVE-2026-89697

Indicators of Compromise

Unexpected NFS SETATTR RPCs from untrusted client IPs targeting exports with sensitive files
Kernel warnings or filesystem journal anomalies referencing notify_change without corresponding mount write accounting
Files on NFS exports showing modified atime/mtime values without matching audit records for authorized writers

Detection Strategies

Inspect running kernel version against the fixed stable branches referenced in the upstream commits and flag hosts still on vulnerable revisions.
Enable auditd rules for the nfsd code path and correlate SETATTR operations with unauthenticated or unexpected source addresses.
Monitor NFS server telemetry (nfsstat -s) for elevated SETATTR call rates that deviate from baseline client behavior.

Monitoring Recommendations

Forward kernel logs and NFS server RPC statistics to a centralized analytics pipeline for baseline deviation analysis.
Alert on RPC SETATTR bursts originating from single client IPs, particularly across multiple exports.
Track patch state of all Linux hosts serving NFS via configuration management to confirm remediation coverage.

How to Mitigate CVE-2026-89697

Immediate Actions Required

Apply the vendor-provided kernel update that includes the fh_want_write() addition in nfsd_proc_setattr().
Restrict NFS server exposure to trusted network segments using firewall rules on TCP/UDP port 2049 and related RPC ports.
Audit /etc/exports for overly permissive entries (for example, * or wide CIDR ranges) and tighten ro, root_squash, and client allowlists.

Patch Information

Upstream fixes are available across multiple stable kernel branches. Review and apply the appropriate commit for your kernel line: 15ca3b64, 21503051, 3eec9d79, 4e475be7, 533964d4, 9229d824, c4a409b8, and d823bf92. Consult your distribution's security tracker for the corresponding backported package.

Workarounds

Disable NFSv2/v3 SETATTR-driven workflows where feasible and rely on NFSv4, which uses a different SETATTR compound path.
Firewall NFS ports at the perimeter and require VPN or IPsec for remote client access until patched kernels are deployed.
Temporarily stop nfs-server on hosts that do not require active NFS exports.

bash

# Example: stop the NFS server pending patch rollout
systemctl stop nfs-server
systemctl disable nfs-server

# Example: restrict NFS access via firewalld to a trusted subnet
firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
firewall-cmd --permanent --zone=trusted --add-service=nfs
firewall-cmd --permanent --zone=public --remove-service=nfs
firewall-cmd --reload

# Verify running kernel against fixed stable commits
uname -r