© 2026 vulntracker.io

CVE-2026-89697

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

CRITICAL

9.1

CVSS Score

Published: September 11, 2026 at 07:46 PM UTC

Updated: October 19, 2026 at 09:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.1

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

90%

1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd83.18.46 4.2cc265089ce1b176dde963c74b53593446ee7f99a

Vendor states this is fixed in 15ca3b64a69caa6194bed8f98a20ed90a11c11dd (fixed)

Vendor states this is fixed in 2150305134889fb2fc25228d35353bd2f6f29500 (fixed)

Vendor states this is fixed in 3eec9d791968c177a4a8cda9af5c04f79dae09cb (fixed)

Vendor states this is fixed in 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc (fixed)

Vendor states this is fixed in 533964d420d385e11b08dd4c56c66ef5dcccaf08 (fixed)

Vendor states this is fixed in 9229d824b938f4fb0ea7a5dddade51735e6fe6f9 (fixed)

Vendor states this is fixed in c4a409b86a92815181a8e9395c6bf1696ad19175 (fixed)

Vendor states this is fixed in d823bf9285cdf4514873b85ab5a888878dd4e8f4 (fixed)

Affected range stops below 3.19, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 4.2 (unaffected)

Vendor states this is fixed in 5.10.270 (unaffected)

Vendor states this is fixed in 5.15.221 (unaffected)

Vendor states this is fixed in 6.1.188 (unaffected)

Vendor states this is fixed in 6.12.109 (unaffected)

Vendor states this is fixed in 6.18.50 (unaffected)

Vendor states this is fixed in 6.6.157 (unaffected)

Vendor states this is fixed in 7.2.4 (unaffected)

Vendor states this is fixed in 7.3 (unaffected)

Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord

https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd

Source: cverecord

https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08

Source: cverecord

https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175

Source: cverecord

https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc

Source: cverecord

https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb

Source: cverecord

https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9

Source: cverecord

https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500

Source: cverecord

https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

9.1CRITICALLinux

Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card