SB20260912109 - Improper Validation of Specified Quantity in Input in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89666)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt on-disk timestamp metadata.

The vulnerability exists due to improper validation of specified quantities in input in NFSv3 SETATTR and create operation handlers when processing client-supplied atime or mtime values with an out-of-range nanoseconds field. A remote attacker can send specially crafted NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD requests to corrupt on-disk timestamp metadata.

Affected filesystems include ext4 and XFS with bigtime support.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/54e02f5e32c52fb395f2ee02986a6c6d5608d22b
• https://git.kernel.org/stable/c/55341d8a5a0f5853e70d46f5a55cf06007808f1d
• https://git.kernel.org/stable/c/e2543852152bcf9aeb57da17d9f9219f7df8aafb
• https://git.kernel.org/stable/c/eb0eca7720662ba5847df1510e73801f7f473094