CVE-2026-89706: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89706 Overview

CVE-2026-89706 affects the Linux kernel's NFS server (nfsd) implementation. The vulnerability resides in the async COPY operation handler, which fails to rotate the write verifier (nn->writeverf) when post-copy writeback errors occur in _nfsd_copy_file_range(). A client that receives NFS_UNSTABLE in the CB_OFFLOAD callback issues a follow-up COMMIT to durably persist the copied data. Because the verifier remains unchanged, the server returns the same value the client already holds, and the client incorrectly concludes the data is durable. This violates the UNSTABLE+COMMIT durability contract defined in RFC 7862 section 15.1 and RFC 8881 section 18.32.

Critical Impact
Silent data loss on NFS clients using async server-side COPY when underlying writeback fails, breaking the durability guarantees required by the NFSv4.2 specification.

Affected Products

Linux kernel nfsd subsystem (NFS server) supporting async server-side COPY (NFSv4.2)
Stable branches referenced by fix commits 31d4d0a, 591134e, 6b13d26, 8a08ffe, bf0cd31, c6d2f63, cc5f7ce, and f5cb227
Distributions shipping vulnerable kernels with NFS server workloads

Discovery Timeline

2026-09-11 - CVE-2026-89706 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89706

Vulnerability Analysis

The issue lives in the async COPY path of the Linux kernel NFS server. When a client issues a server-side COPY, the worker kthread captures nn->writeverf at request time and returns it later through the CB_OFFLOAD callback. If vfs_fsync_range() or filemap_check_wb_err() inside _nfsd_copy_file_range() reports an error, the worker correctly leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes wr_stable_how as NFS_UNSTABLE. However, the server does not rotate its write verifier at the failure site.

A compliant NFSv4.2 client interprets NFS_UNSTABLE as a signal to issue a COMMIT before considering the data durable. When the client sends COMMIT, the server returns the unchanged verifier that matches the value already delivered via CB_OFFLOAD. The client concludes that its copy is safely on stable storage and drops the data from its cache, even though writeback actually failed. This is an integrity failure rather than an availability or confidentiality failure.

Root Cause

The async COPY writeback-failure path lacked a call equivalent to commit_reset_write_verifier(). The kthread has no svc_rqst context, so the trace-emitting helper is unavailable. The fix invokes nfsd_reset_write_verifier() directly, mirroring the approach already used by nfsd_file_check_write_error(). The patch also filters out -EAGAIN and -ESTALE, since neither indicates a durable-storage failure.

Attack Vector

The vulnerability is reachable over the network by any NFSv4.2 client authorized to issue COPY operations against an affected server. No authentication beyond normal NFS mount privileges is required. Triggering the condition depends on transient or persistent writeback errors on the backing filesystem, so exploitation is opportunistic rather than fully attacker-controlled. The consequence is silent data corruption at the client, not code execution.

Detection Methods for CVE-2026-89706

Indicators of Compromise

Kernel log entries indicating vfs_fsync_range() or filemap_check_wb_err() failures on NFS-exported filesystems coinciding with server-side COPY activity
CB_OFFLOAD callbacks reporting wr_stable_how=NFS_UNSTABLE followed by successful COMMIT responses despite backing-store I/O errors
Application-level data inconsistencies on NFS clients after using server-side COPY (e.g., truncated or missing file ranges)

Detection Strategies

Monitor nfsd kernel log messages and tracepoints for write-error events on exports that permit COPY operations
Correlate underlying block-device or filesystem error counters (dmesg, smartctl, /proc/diskstats) with active NFS COPY workloads
Audit running kernel versions across the fleet and flag hosts serving NFS that have not received the fix commits

Monitoring Recommendations

Ingest kernel and NFS server telemetry into a centralized log platform and alert on writeback-error patterns
Track NFSv4.2 COPY usage per export to identify high-value systems where silent data loss would have the greatest impact
Include NFS server kernel versions in configuration-management drift reports

How to Mitigate CVE-2026-89706

Immediate Actions Required

Inventory Linux hosts operating as NFSv4.2 servers with async server-side COPY enabled
Apply the upstream kernel fix or a distribution-provided kernel that includes the referenced stable commits
Reboot affected servers after patching to load the corrected nfsd module

Patch Information

The fix rotates nn->writeverf at the async COPY writeback-failure site by calling nfsd_reset_write_verifier() directly, filtering out -EAGAIN and -ESTALE returns. Apply one of the following stable commits based on your kernel branch: 31d4d0a, 591134e, 6b13d26, 8a08ffe, bf0cd31, c6d2f63, cc5f7ce, or f5cb227.

Workarounds

Disable server-side COPY offload on affected NFS servers until a patched kernel is deployed, forcing clients to fall back to client-driven read/write copy semantics
Restrict NFSv4.2 mounts to trusted, well-monitored clients where application-level integrity checks can catch silent data loss
Ensure backing filesystems are healthy and monitor SMART, RAID, and filesystem error counters aggressively to reduce the window in which writeback failures occur

bash

# Verify running kernel version and nfsd module status
uname -r
lsmod | grep nfsd

# Check whether server-side COPY is being used on an export
trace-cmd record -e nfsd:nfsd_copy_async