SB2026091291 - Improper control of a resource through its lifetime in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89697)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a SETATTR operation without a mount write reference.

The vulnerability exists due to missing mount write reference acquisition in nfsd_proc_setattr() when processing a SETATTR request in the BOTH_TIME_SET branch. A remote attacker can submit a SETATTR request with both time attributes set to perform a SETATTR operation without a mount write reference.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd
• https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc
• https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08
• https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175