CVE-2026-89701: nfsd: validate nseconds in TIME_DELEG decode paths
In the Linux kernel, the following vulnerability has been resolved:
nfsd: validate nseconds in TIMEDELEG decode paths
The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds < NSECPERSEC. The legacy nfsd4decodenfstime4 has this check but the TIMEDELEG paths do not. A malformed timespec can propagate through notifychange() to disk.
Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CBGETATTR path).
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the vulnerable code paths?
An attacker would need to provide malformed NFSv4 TIME_DELEG_ACCESS or TIME_DELEG_MODIFY timestamp data containing an nseconds value that is not less than NSEC_PER_SEC. The affected decode paths are the SETATTR path in nfs4xdr.c and the CB_GETATTR callback path in nfs4callback.c.
What is the potential effect of successful exploitation?
The unchecked uint32_t nseconds value can be stored in tv_nsec as an invalid timespec. That malformed timestamp can then propagate through notify_change() to disk.
How can I determine whether a system contains the fix?
Check whether the kernel includes validation of nseconds values in both TIME_DELEG decode paths: the SETATTR decoding in nfs4xdr.c and CB_GETATTR decoding in nfs4callback.c. The referenced stable kernel commits contain the remediation.