CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add fhwantwrite() for early-verified SETATTR in nfsdprocsetattr()
The BOTHTIMESET branch calls fhverify() early so setattrprepare() can inspect the dentry. This causes nfsdsetattr() to skip fhwantwrite(), so notifychange() runs without a mount write reference.
Add the missing fhwantwrite() call after the early fhverify().
Affected Software
Event History
Frequently Asked Questions
What configuration and operation are implicated?
The affected path is the NFS server's SETATTR handling in the Linux kernel. Specifically, it occurs when the BOTH_TIME_SET branch performs early file-handle verification before updating attributes.
What is the immediate effect of the flaw?
The early verification causes nfsd_setattr() to skip acquiring a mount write reference. As a result, notify_change() can run without that required mount write reference.
What does the available fix change?
The fix adds an fh_want_write() call after the early fh_verify() in the affected SETATTR path, ensuring a mount write reference is obtained before notify_change() executes.