CVE-2026-89678

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix partial-write detection in nfsd_direct_write

nfsd_direct_write() walks a list of write segments and, after each

vfs_iocb_iter_write(), tries to detect a short write so the loop can

stop before placing the next segment at a wrong file offset:

host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);

if (host_err < 0)

return host_err;

*cnt += host_err;

if (host_err < segments[i].iter.count)

break; /* partial write */

vfs_iocb_iter_write() runs the iter through ->write_iter(), which

advances the iter by the number of bytes written. By the time the

check runs, segments[i].iter.count is the residual, not the original

request length:

before write_iter: iter.count == original_len

after write_iter: iter.count == original_len - host_err

The condition then reduces to host_err < original_len - host_err, so

the break fires only when less than half of the segmen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References