CVE-2026-89678: nfsd: fix partial-write detection in nfsd_direct_write

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix partial-write detection in nfsddirectwrite

nfsddirectwrite() walks a list of write segments and, after each vfsiocbiterwrite(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset:

hosterr = vfsiocbiterwrite(file, kiocb, &segments[i].iter); if (hosterr < 0) return hosterr; cnt += hosterr; if (hosterr < segments[i].iter.count) break; / partial write /

vfsiocbiterwrite() runs the iter through ->writeiter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length:

before writeiter: iter.count == originallen after writeiter: iter.count == originallen - hosterr

The condition then reduces to hosterr < originallen - hosterr, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->kipos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting cnt to the NFS client.

Snapshot the segment's byte count before the write and compare hosterr against that snapshot so any short write breaks the loop.

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Which systems are exposed to the incorrect write behavior?

Linux kernel systems using the NFS server direct-write path are affected when that path processes multiple write segments. The issue requires a short write that completes more than half, but less than all, of a segment.

2

What is the practical impact when the condition occurs?

The server can continue with the next segment using a file offset advanced only by the short-write amount. This can place the next segment's data at the wrong offset, overwrite data, and cause the reported write count to exceed the data actually written.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203