CVE-2026-89713: Linux Kernel NFSD Race Condition Vulnerability

CVE-2026-89713 Overview

CVE-2026-89713 is a time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's NFS server (NFSD) subsystem. The flaw resides in nfsd_setattr(), which evaluates whether a size update requires the NFSD_MAY_TRUNC permission before acquiring inode_lock(). A remote NFS client can exploit this window to truncate append-only files that should be protected from shrinking operations. The vulnerability affects integrity and availability of files served over NFS.

Critical Impact
A network-based attacker with NFS access can truncate append-only files without authorization, bypassing the IS_APPEND(inode) protection enforced by the VFS layer during standard truncate syscalls.

Affected Products

Linux kernel NFSD subsystem (versions prior to patched commits)
Systems exporting file systems via NFS server
Distributions shipping vulnerable kernel builds

Discovery Timeline

2026-09-11 - CVE-2026-89713 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89713

Vulnerability Analysis

The NFSD code path in nfsd_setattr() samples the file size without holding inode_lock() and uses that unlocked read to decide whether the operation requires NFSD_MAY_TRUNC. The actual ATTR_SIZE update runs later under the lock through notify_change(). This gap allows the file state observed during the permission check to drift from the state modified during the write.

For append-only files, the mismatch has direct security consequences. A client sending a SETATTR request that does not shrink the file at sample time bypasses the truncate permission check. A concurrent append then extends the file before nfsd_setattr() acquires the lock, and notify_change() applies the truncation without rejecting the operation on IS_APPEND(inode) files.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw. NFSD makes an authorization decision based on unlocked file metadata, then performs the mutating operation under a lock without revalidating the state. Standard VFS truncate syscall paths perform append-only checks immediately before calling notify_change(), but NFSD did not follow this pattern.

Attack Vector

An attacker with network access to an NFS export can trigger the race by issuing a SETATTR request with a target size that appears non-shrinking relative to the current sampled size. Simultaneously, another client (or the same client) writes data via appends that extend the file past the SETATTR target. When NFSD later acquires the inode lock, the requested size becomes a real truncation, and the append-only protection is silently skipped.

The upstream fix splits write-count acquisition from the truncate permission check. get_write_access() still runs before the locked setattr work, but the code now re-evaluates whether the requested size is below i_size_read(inode) after inode_lock() is held and before notify_change(ATTR_SIZE) executes. This eliminates the plain unlocked inode->i_size load.

Detection Methods for CVE-2026-89713

Indicators of Compromise

Unexpected shrinking of files marked with the append-only attribute (chattr +a) on NFS-exported file systems.
NFSD audit records showing SETATTR operations that reduce file size on files where IS_APPEND is set.
Log inconsistencies where append-only journal or audit files show truncation events without administrator action.

Detection Strategies

Monitor kernel version against patched commits 3afa17d, 4408625, b778e0e, and d8352da across the fleet.
Instrument audit rules (auditctl -w) on directories containing append-only files exported over NFS to capture size-change events.
Correlate NFS SETATTR operations with concurrent WRITE operations against the same file handle to identify race-condition attempts.

Monitoring Recommendations

Track file integrity of critical append-only files (system logs, WORM archives, audit trails) using tools such as AIDE or Tripwire.
Alert on NFS clients issuing SETATTR calls with size attribute against files owned by logging or audit users.
Review NFS server metrics for anomalous SETATTR rates that may indicate exploitation attempts against the TOCTOU window.

How to Mitigate CVE-2026-89713

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 3afa17d, 4408625, b778e0e, and d8352da as they land in your distribution's stable kernel updates.
Inventory NFS servers and prioritize patching hosts that export file systems containing append-only files.
Restrict NFS export access to trusted client networks using /etc/exports and firewall rules until patches are deployed.

Patch Information

The fix is committed to the Linux kernel stable trees. Refer to the upstream commits: Kernel Git Commit 3afa17d, Kernel Git Commit 4408625, Kernel Git Commit b778e0e, and Kernel Git Commit d8352da. The patch moves the truncate permission check under inode_lock() and rechecks the size relative to i_size_read(inode) before invoking notify_change(ATTR_SIZE).

Workarounds

Limit NFS exports containing append-only files to read-only mode where feasible using the ro export option.
Enforce network segmentation so that only authenticated hosts can reach the NFS server ports (TCP/UDP 2049).
Consider migrating append-only workloads to local storage or object storage with server-side WORM enforcement until kernels are patched.

bash

# Restrict NFS export to trusted subnet in read-only mode
# /etc/exports
/srv/audit_logs  10.0.10.0/24(ro,sync,no_subtree_check,root_squash)

# Apply changes
exportfs -ra

# Verify current exports
exportfs -v