CVE-2026-89704: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89704 Overview

CVE-2026-89704 is a race condition in the Linux kernel's NFS server (nfsd) that can cause silent data loss during asynchronous NFSv4 COPY operations. The flaw resides in _nfsd_copy_file_range(), which samples the destination file's writeback error cursor (dst->f_wb_err) into a local since variable after the copy loop completes. A concurrent COMMIT or stable WRITE on the same inode can advance the cursor first, causing filemap_check_wb_err() to miss writeback failures. The server then falsely reports NFSD4_COPY_F_COMMITTED and encodes wr_stable_how = FILE_SYNC4 in the CB_OFFLOAD callback, leading the NFS client to treat corrupted or unwritten data as durable.

Critical Impact
A remote NFS client can experience silent data loss because writeback errors during async COPY operations are masked by a concurrent COMMIT advancing the shared error cursor.

Affected Products

Linux kernel versions containing the nfsd async COPY implementation prior to the referenced fix commits
Distributions shipping vulnerable stable kernel branches referenced by commits 20a67a7d, 322422d6, 435e4246, 4728504c, 52b2db7a, 8277d4a1, 9f539a1c, and a1cbafe7
NFS server deployments serving NFSv4.2 clients that issue asynchronous COPY operations

Discovery Timeline

2026-09-11 - CVE-2026-89704 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89704

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the NFS server's asynchronous COPY handling. The _nfsd_copy_file_range() function samples the destination file's writeback error sequence cursor into since only after the copy loop finishes writing data. It then relies on filemap_check_wb_err() after vfs_fsync_range() to determine whether any writeback error occurred.

The nfsd_file cache reuses a single struct file across requests targeting the same inode. A concurrent COMMIT or stable WRITE on the destination advances dst->f_wb_err to the current mapping->wb_err via file_check_and_advance_wb_err() during its own vfs_fsync_range(). When that advancement happens between the writeback error appearing in mapping->wb_err and the COPY worker sampling since, errseq_check() sees cur == since and returns zero.

The COPY operation then completes without reporting the failure. NFSD sets NFSD4_COPY_F_COMMITTED, and the CB_OFFLOAD callback encodes wr_stable_how = FILE_SYNC4. The client treats the copied data as safely persisted even though writeback failed at the storage layer.

Root Cause

The root cause is incorrect ordering of the errseq_t cursor sample relative to concurrent operations sharing the same cached struct file. Sampling since after the write loop allows another thread to consume the error notification first, breaking the errseq contract that requires each observer to sample the cursor before performing writes it wants to check.

Attack Vector

The attack vector is network-based and requires no authentication beyond normal NFS access. An unprivileged NFS client can trigger the condition by concurrently issuing async COPY operations and COMMIT or stable WRITE requests targeting the same destination inode. Under storage-layer failure conditions such as ENOSPC or EIO, the race causes writeback errors to be silently discarded. Exploitation does not require crafted payloads; it depends on request timing against shared inode state.

The upstream fix moves the since sample to the start of _nfsd_copy_file_range(), matching the pattern used by nfsd_vfs_write() and nfsd4_clone_file_range(). See Kernel Commit 20a67a7 for the reference implementation.

Detection Methods for CVE-2026-89704

Indicators of Compromise

Client-side data integrity failures on files recently written via NFSv4.2 COPY where the server reported success
Kernel log entries showing writeback errors (EIO, ENOSPC) on NFS-exported filesystems that do not correlate with client-visible COPY errors
Divergence between server-side storage error counters and NFS operation error counts reported to clients

Detection Strategies

Audit kernel versions on NFS server hosts against the fixed stable branches referenced in the upstream commits
Correlate NFS server nfsd COPY completion telemetry with underlying block layer and filesystem error events
Monitor for concurrent COPY, COMMIT, and stable WRITE traffic targeting the same inode from NFSv4.2 clients

Monitoring Recommendations

Enable NFS server operation tracing to capture async COPY completion status alongside CB_OFFLOAD callback contents
Track filesystem-level writeback error counters (/sys/fs/*, dmesg) and alert on divergence from NFS-reported success rates
Deploy endpoint telemetry on NFS server hosts to capture kernel version, module load state, and configuration changes to nfsd

How to Mitigate CVE-2026-89704

Immediate Actions Required

Inventory Linux hosts exporting NFSv4.2 shares and identify kernel versions lacking the referenced fix commits
Apply the vendor-supplied stable kernel update that incorporates the nfsd async COPY writeback-error fix
Validate that critical workloads relying on NFSv4.2 server-side COPY have integrity verification available at the application layer until patching completes

Patch Information

The fix samples the writeback error cursor once at the start of _nfsd_copy_file_range() so the cursor reflects state before the COPY issues any writes. This aligns the async COPY path with the patterns used by nfsd_vfs_write() and nfsd4_clone_file_range(). Distribution vendors have backported the change across multiple stable branches; see the referenced commits including Kernel Commit 322422d, Kernel Commit 435e424, Kernel Commit 4728504, Kernel Commit 52b2db7, Kernel Commit 8277d4a, Kernel Commit 9f539a1, and Kernel Commit a1cbafe.

Workarounds

Disable server-side COPY offload on NFSv4.2 exports so clients fall back to READ/WRITE round-trips that surface errors directly
Restrict NFS export access to trusted client networks to reduce concurrent request pressure that triggers the race
Configure application-layer checksums or post-copy verification for workloads that depend on NFS COPY durability guarantees