SB20260912105 - Incorrect calculation in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-89678)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt file data and cause incorrect write-count reporting.

The vulnerability exists due to incorrect partial-write detection in nfsd_direct_write() when processing direct-write segments that complete partially. A remote attacker can submit a write request that results in a partial segment write to corrupt file data and cause incorrect write-count reporting.

Only short writes completing between 50% and 99% of a segment bypass detection.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/250ec14932d5cfe102f68a57892bb566eee7f83e
• https://git.kernel.org/stable/c/fa6590dfd16ab55f03b658b079072ace3504825e