CVE-2026-89713

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A remote attacker, by sending a crafted file attribute modification request (SETATTR) while a file is being concurrently appended, could exploit a time-of-check to time-of-use (TOCTOU) vulnerability. This could lead to the unauthorized truncation of append-only files, potentially resulting in data loss.

Red Hat has rated this vulnerability as having Important severity because an attacker can circumvent append-only file protections and reduce file sizes, directly compromising filesystem integrity. This issue only affects systems configured to act as NFS servers, a service that is disabled by default on standard Red Hat Enterprise Linux installations. To trigger the defect, a client must already possess write permissions to an export and win a race condition against concurrent file appends.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the NFS server service on systems where network file sharing is not required:

systemctl stop nfs-server.service
systemctl disable nfs-server.service

Alternatively, if NFS exports are necessary, restrict network access to trusted client hosts or subnets using firewall rules:

firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" service name="nfs" accept'
firewall-cmd --reload

Caveats: Stopping the NFS service or modifying firewall rules will disconnect active NFS clients, block access to exported shares, and may break dependent applications.

Warning: Stopping or reloading services will immediately terminate active network sessions and cause operational disruption.