CVE-2026-89665

A flaw was found in the Linux kernel's nfsd component. A remote attacker could exploit this vulnerability by sending a specially crafted NFSv2 SETATTR or CREATE request with an out-of-range 'useconds' value. This could lead to incorrect timestamps being written to the filesystem, resulting in data corruption. Additionally, such malformed requests may cause a Denial of Service (DoS) by triggering an RPC GARBAGE_ARGS reply.

An input validation flaw in the NFSv2 server sattr decoder allows out-of-range useconds values to be converted to nanoseconds before the raw range is checked. On 32-bit ILP32 systems the tmp2 * NSEC_PER_USEC multiplication can wrap and produce an apparently valid tv_nsec value, so malformed SETATTR or CREATE RPCs may be accepted with incorrect timestamp data. The atime handling also missed the Sun server time convention for useconds 1000000, allowing an invalid one second nanosecond value to reach filesystem code in some requests. For the CVSS the PR:N is used for the paranoid network exposed case where an attacker can send NFSv2 RPCs to a writable or anonymous export without local privileges on the server. The issue is network reachable only when nfsd serves NFSv2 to an attacker reachable export. Impact is primarily low integrity impact to file timestamp metadata, with no clear memory corruption or privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.