CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When setting file attributes using nfsd_proc_setattr(), a specific code path (BOTH_TIME_SET branch) prematurely verifies file handles. This bypasses a critical write verification step (fh_want_write()), allowing file attribute changes to proceed without a proper mount write reference. This could lead to unauthorized modification of file metadata or content, potentially impacting data integrity.

An NFS server SETATTR path can run notify_change() without taking a mount write reference because the BOTH_TIME_SET path calls fh_verify() early and then skips fh_want_write() later. This can bypass mount level write gating such as read-only or frozen mount protection and may allow remote metadata changes when the server should reject the operation. For the CVSS the PR:N is used in the paranoid score because some NFS exports can be reachable with anonymous or weak AUTH_SYS style access, while the base score uses PR:L for deployments where valid export access and setattr permission are required. The issue is network reachable through nfsd when the affected NFS SETATTR path is exposed. Impact is mainly limited integrity policy bypass and possible availability impact from violating mount write barriers, not memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.