CVE-2026-89666

A flaw was found in the kernel. A remote attacker, acting as an NFSv3 client, can send malformed time values during SETATTR or create operations. This can lead to the corruption of on-disk metadata, resulting in incorrect timestamps for files. This issue affects filesystems that support nanosecond granularity, such as ext4 and XFS.

An NFSv3 server can accept a client supplied atime or mtime whose nseconds field is outside the valid timespec64 range. The value is valid on the wire but invalid for kernel timestamp storage, and it can be stored into inode metadata without being normalized. On filesystems such as ext4 or XFS bigtime this can corrupt the encoded on disk timestamp and make the stored seconds or year wrong when read back. For the CVSS the PR:L is used because a client normally needs access to the exported NFS namespace and permission to issue SETATTR or create operations. The issue is network reachable through NFSv3 procedures such as SETATTR, CREATE, MKDIR, SYMLINK, and MKNOD. Impact is mainly persistent integrity impact on file metadata, not kernel memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.