CVE-2026-89666— nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： nfsd：拒绝 NFSv3 SETATTR 和创建操作中超范围的 nseconds 客户端可以发送携带 或 的 NFSv3 SETATTR、CREATE、MKDIR、SYMLINK 或 MKNOD 请求，其中 字段超出有效范围。该值在传输层格式正确，能干净地解码为有效的 ，但其数值不是合法的 ： 必须小于 。 在 setattr 路径中，没有任何地方对该值进行限幅（clamping）。 会将时间值通过 处理；当文件系统支持纳秒粒度（ ）时，该函数不会将 缩小到小于 。此外，
Possible ATT&CK Techniques 3 AI
T1218 · System Binary Proxy Execution T1027 · Obfuscated Files or Information T1070 · Indicator RemovalAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 55341d8a5a0f5853e70d46f5a55cf06007808f1d |
affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 54e02f5e32c52fb395f2ee02986a6c6d5608d22b |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< e2543852152bcf9aeb57da17d9f9219f7df8aafb |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< eb0eca7720662ba5847df1510e73801f7f473094 |
affected | ||
2.6.12 |
affected | ||
< 2.6.12 |
unaffected | ||
6.12.109≤ 6.12.* |
unaffected | ||
6.18.50≤ 6.18.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89666
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD
carrying an atime or mtime whose nseconds field is out of range. The
value is well-formed on the wire and decodes cleanly into a valid
uint32, but it is not a valid timespec64: tv_nsec must be less than
NSEC_PER_SEC.
Nothing in the setattr path clamps it. notify_change() runs the time
through timestamp_truncate(), which does not reduce tv_nsec below
NSEC_PER_SEC when the filesystem supports nanosecond granularity
(s_time_gran == 1), and the inode atime/mtime setters store it verbatim
(only ctime is normalized, via inode_set_ctime_to_ts()). The
un-normalized value then corrupts on-disk metadata: ext4's
ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which
overflows the 32-bit extra field and clobbers the seconds-epoch bits, so
the stored seconds (and thus the year) are wrong on read-back. XFS with
bigtime mis-stores the timestamp for the same reason.
Validate the client-supplied atime/mtime in the proc handlers and return
NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL
for SETATTR and describes it as the error for a value the server 'can
not store ... in its own representation'; the client maps it to EINVAL.
Checking in the proc handlers, rather than in nfsd_setattr(), keeps the
rejection in front of object creation. The create operations create the
object before nfsd_create_setattr() runs, so a late failure would leave
the new object behind and turn a non-idempotent request into a namespace
change that reports failure. The check is therefore done up front, for
the create operations before the object is created.
tv_nsec is a long, so the comparison casts it to unsigned long (the same
width) rather than to u32, matching timespec64_valid(). A u32 cast would
truncate on 64-bit; the unsigned long cast also rejects a value that
became negative when an out-of-range u32 wire nseconds was assigned to a
32-bit long.
Only client-supplied times are checked: SET_TO_SERVER_TIME requests
carry no client value. The sattrguard3 ctime is deliberately left alone:
an out-of-range guard simply never matches the object's ctime and yields
NFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the
protocol-correct outcome rather than rejecting the request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89666
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89666
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-89666 (4)
Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total
| CVE-2026-89491 | ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() | |
| CVE-2026-89477 | sctp: fix NULL deref on untransmitted RECONF completion | |
| CVE-2026-89478 | sctp: drop a chunk if its transport was removed | |
| CVE-2026-89479 | sctp: stop processing a packet once its association is deleted | |
| CVE-2026-89480 | nvme-tcp: reject a read that transferred too few bytes | |
| CVE-2026-89482 | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | |
| CVE-2026-89481 | nvme-tcp: fix host memory disclosure on R2T for a read command | |
| CVE-2026-89483 | nvme: zero the discard fallback page | |
| CVE-2026-89484 | lockd: fix NULL dereference on lockowner allocation failure | |
| CVE-2026-89485 | lockd: pin next file across nlm_inspect_file lock-drop | |
| CVE-2026-89486 | ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() | |
| CVE-2026-89487 | openvswitch: only skb_tx_error() a packet we are about to drop | |
| CVE-2026-89488 | openvswitch: Fix CT limit teardown use-after-free | |
| CVE-2026-89489 | openrisc: fix arbitrary kernel memory access via or1k_atomic syscall | |
| CVE-2026-89500 | ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page | |
| CVE-2026-89497 | orangefs: skip leading spaces before parsing client debug masks | |
| CVE-2026-89498 | orangefs: fix double-free of trailer_buf on readdir copy failure | |
| CVE-2026-89499 | ring-buffer: Stop remote reader update when page swap fails | |
| CVE-2026-89496 | ocfs2: always run deallocs on copy-on-write completion | |
| CVE-2026-89501 | ring-buffer: Hold cpu_buffer::lock when resizing a subbuf |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
Same vendor: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
V. Comments for CVE-2026-89666
No comments yet