CVE-2026-89704

A flaw was found in the Linux kernel's nfsd component. The _nfsd_copy_file_range() function incorrectly samples the writeback error cursor after the copy loop. This allows a concurrent write operation to advance the error cursor prematurely. As a result, the system may report that data has been successfully committed even when writeback errors have occurred, leading to silent data loss where clients perceive data as durable when it is not.

An async NFS server side COPY can miss a writeback error because _nfsd_copy_file_range samples the dst f_wb_err cursor after the copy loop. A concurrent COMMIT or stable WRITE that reuses the same cached struct file can advance the shared writeback error cursor before the COPY worker checks it, making errseq_check report success even though writeback failed. This can make NFSD report the offloaded copy as committed with FILE_SYNC4 and the client may treat the copied data as durable, resulting in silent data loss. For the CVSS the PR:L is selected because the attacker typically needs valid NFS access and write or COPY permission on the exported filesystem. The issue is network reachable from clients that can access the NFSv4.2 server side COPY path, but practical exploitation also depends on concurrent operations and a real writeback failure. Impact is primarily integrity loss rather than kernel crash or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.