CVE-2026-89678

A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The nfsd_direct_write() function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic for detecting short writes compares the actual bytes written against a residual count rather than the original requested length. As a result, partial writes between 50% and 99% of the intended size are not properly identified, leading to subsequent data being written at incorrect file offsets and the NFS client receiving an inaccurate report of bytes written. This can allow a remote attacker to cause data corruption on the NFS server.

An incorrect partial write check in nfsd_direct_write can fail to detect a short direct IO write because the segment iterator count is reduced by write_iter before the comparison occurs. An NFS client with write access can cause the next write segment to be placed at an incorrect file offset after a partial write, resulting in corruption of data in the exported file and an incorrect reported write count. For the CVSS the PR:L is used because the attacker needs access to an NFS export with permission to write the affected file. The issue is network reachable through an NFS server export, although reliable triggering requires a partial direct IO write and is likely dependent on filesystem or storage conditions. Impact includes integrity loss and limited availability impact through corruption of application data. NFS services are commonly restricted to trusted internal networks, but affected exports reachable by untrusted clients should be reviewed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.