CVE-2026-89701

A flaw was found in the Linux kernel's Network File System Daemon (nfsd). The TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths do not properly validate the nanosecond (nseconds) value in timestamps. This allows a remote attacker to provide a malformed timestamp, which can then be written to disk, potentially leading to data integrity issues or unexpected system behavior.

A moderate-impact flaw was found in the Linux kernel Network File System daemon (nfsd) as shipped in Red Hat Enterprise Linux 10 and OpenShift 5. The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths store the nseconds component of a client-supplied timestamp directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC, a range check that the legacy nfsd4_decode_nfstime4 decoder performs. An authenticated NFS client holding a delegation can therefore supply a malformed timespec that propagates through notify_change() and is written to disk, potentially corrupting file timestamps and causing data integrity issues or unexpected system behavior. Red Hat rates this flaw Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting an assessment that exploitation primarily affects availability. Red Hat Enterprise Linux 7, 8, and 9 streams and OpenShift 4 releases are not affected because the vulnerable TIME_DELEG decode code is not present in the kernel versions shipped in those products. For the affected Red Hat Enterprise Linux 10 and OpenShift 5 streams the fix is currently deferred to a future update, leaving the residual risk that a malicious or misbehaving authenticated NFS client can persist malformed timestamps on an affected nfsd server until a corrected kernel is released.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.