CVE-2026-89713

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: check truncate permission under inode lock

nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC

before it takes inode_lock(). The comparison uses the file size sampled

by that unlocked read, but the actual ATTR_SIZE update is applied later

under inode_lock() by notify_change().

This leaves a TOCTOU window for append-only files. If a client sends a

SETATTR that does not shrink the file at the time of the unlocked

sample, a concurrent append can extend the file before nfsd_setattr()

takes inode_lock(). notify_change() then applies a real truncation

without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS

truncate syscall paths perform their own append-only checks before

calling notify_change(), so NFSD must make this decision against the

locked size it is about to change.

Split the write-count acquisition from the truncation permission check.

Keep get_write_access() before the locked

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References