{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89678", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.747Z", "datePublished": "2026-09-11T19:46:02.184Z", "dateUpdated": "2026-09-11T19:46:02.184Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:02.184Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix partial-write detection in nfsd_direct_write\n\nnfsd_direct_write() walks a list of write segments and, after each\nvfs_iocb_iter_write(), tries to detect a short write so the loop can\nstop before placing the next segment at a wrong file offset:\n\n host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);\n if (host_err < 0)\n return host_err;\n *cnt += host_err;\n if (host_err < segments[i].iter.count)\n break;\t/* partial write */\n\nvfs_iocb_iter_write() runs the iter through ->write_iter(), which\nadvances the iter by the number of bytes written. By the time the\ncheck runs, segments[i].iter.count is the residual, not the original\nrequest length:\n\n before write_iter: iter.count == original_len\n after write_iter: iter.count == original_len - host_err\n\nThe condition then reduces to host_err < original_len - host_err, so\nthe break fires only when less than half of the segment was written.\nAny short write completing between 50% and 99% of the segment slips\nthrough; the loop advances to the next segment with kiocb->ki_pos\nonly bumped by the short amount, writing the next segment's payload\nat the wrong offset and over-reporting *cnt to the NFS client.\n\nSnapshot the segment's byte count before the write and compare\nhost_err against that snapshot so any short write breaks the loop."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "lessThan": "fa6590dfd16ab55f03b658b079072ace3504825e", "status": "affected", "versionType": "git"}, {"version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "lessThan": "250ec14932d5cfe102f68a57892bb566eee7f83e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"}, {"url": "https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e"}], "title": "nfsd: fix partial-write detection in nfsd_direct_write", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa6590dfd16ab55f03b658b079072ace3504825e", "status": "affected", "version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "versionType": "git"}, {"lessThan": "250ec14932d5cfe102f68a57892bb566eee7f83e", "status": "affected", "version": "06c5c97293e3fca99ce15da157068edf45a7c6e4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix partial-write detection in nfsd_direct_write\n\nnfsd_direct_write() walks a list of write segments and, after each\nvfs_iocb_iter_write(), tries to detect a short write so the loop can\nstop before placing the next segment at a wrong file offset:\n\n host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);\n if (host_err < 0)\n return host_err;\n *cnt += host_err;\n if (host_err < segments[i].iter.count)\n break;\t/* partial write */\n\nvfs_iocb_iter_write() runs the iter through ->write_iter(), which\nadvances the iter by the number of bytes written. By the time the\ncheck runs, segments[i].iter.count is the residual, not the original\nrequest length:\n\n before write_iter: iter.count == original_len\n after write_iter: iter.count == original_len - host_err\n\nThe condition then reduces to host_err < original_len - host_err, so\nthe break fires only when less than half of the segment was written.\nAny short write completing between 50% and 99% of the segment slips\nthrough; the loop advances to the next segment with kiocb->ki_pos\nonly bumped by the short amount, writing the next segment's payload\nat the wrong offset and over-reporting *cnt to the NFS client.\n\nSnapshot the segment's byte count before the write and compare\nhost_err against that snapshot so any short write breaks the loop."}], "id": "CVE-2026-89678", "lastModified": "2026-09-11T20:19:54.523", "metrics": {}, "published": "2026-09-11T20:19:54.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: NFS daemon (nfsd) data corruption due to incorrect partial-write detection", "id": "2532180", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532180"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-823", "details": ["A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The `nfsd_direct_write()` function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic for detecting short writes compares the actual bytes written against a residual count rather than the original requested length. As a result, partial writes between 50% and 99% of the intended size are not properly identified, leading to subsequent data being written at incorrect file offsets and the NFS client receiving an inaccurate report of bytes written. This can allow a remote attacker to cause data corruption on the NFS server."], "name": "CVE-2026-89678", "public_date": "2026-09-11T19:46:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89678\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89678\nhttps://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e\nhttps://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e"], "threat_severity": "Important"}

{}