CVE-2026-89678: nfsd: fix partial-write detection in nfsd_direct_write
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix partial-write detection in nfsddirectwrite
nfsddirectwrite() walks a list of write segments and, after each vfsiocbiterwrite(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset:
hosterr = vfsiocbiterwrite(file, kiocb, &segments[i].iter); if (hosterr < 0) return hosterr; cnt += hosterr; if (hosterr < segments[i].iter.count) break; / partial write /
vfsiocbiterwrite() runs the iter through ->writeiter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length:
before writeiter: iter.count == originallen after writeiter: iter.count == originallen - hosterr
The condition then reduces to hosterr < originallen - hosterr, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->kipos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting cnt to the NFS client.
Snapshot the segment's byte count before the write and compare hosterr against that snapshot so any short write breaks the loop.
Event History
Frequently Asked Questions
Which systems are exposed to the incorrect write behavior?
Linux kernel systems using the NFS server direct-write path are affected when that path processes multiple write segments. The issue requires a short write that completes more than half, but less than all, of a segment.
What is the practical impact when the condition occurs?
The server can continue with the next segment using a file offset advanced only by the short-write amount. This can place the next segment's data at the wrong offset, overwrite data, and cause the reported write count to exceed the data actually written.