CVE-2026-89666: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on the wire and decodes cleanly into a valid uint32, but it is not a valid timespec64: tvnsec must be less than NSECPERSEC.

Nothing in the setattr path clamps it. notifychange() runs the time through timestamptruncate(), which does not reduce tvnsec below NSECPERSEC when the filesystem supports nanosecond granularity (stimegran == 1), and the inode atime/mtime setters store it verbatim (only ctime is normalized, via inodesetctimetots()). The un-normalized value then corrupts on-disk metadata: ext4's ext4encodeextratime() shifts tvnsec left by EXT4EPOCHBITS, which overflows the 32-bit extra field and clobbers the seconds-epoch bits, so the stored seconds (and thus the year) are wrong on read-back. XFS with bigtime mis-stores the timestamp for the same reason.

Validate the client-supplied atime/mtime in the proc handlers and return NFS3ERRINVAL before anything is changed. RFC 1813 lists NFS3ERRINVAL for SETATTR and describes it as the error for a value the server 'can not store ... in its own representation'; the client maps it to EINVAL.

Checking in the proc handlers, rather than in nfsdsetattr(), keeps the rejection in front of object creation. The create operations create the object before nfsdcreatesetattr() runs, so a late failure would leave the new object behind and turn a non-idempotent request into a namespace change that reports failure. The check is therefore done up front, for the create operations before the object is created.

tvnsec is a long, so the comparison casts it to unsigned long (the same width) rather than to u32, matching timespec64valid(). A u32 cast would truncate on 64-bit; the unsigned long cast also rejects a value that became negative when an out-of-range u32 wire nseconds was assigned to a 32-bit long.

Only client-supplied times are checked: SETTOSERVERTIME requests carry no client value. The sattrguard3 ctime is deliberately left alone: an out-of-range guard simply never matches the object's ctime and yields NFS3ERRNOTSYNC via the existing guardtime comparison, which is the protocol-correct outcome rather than rejecting the request.