CVE-2026-89665
Description
A flaw was found in the Linux kernel's nfsd component. A remote attacker could exploit this vulnerability by sending a specially crafted NFSv2 SETATTR or CREATE request with an out-of-range 'useconds' value. This could lead to incorrect timestamps being written to the filesystem, resulting in data corruption. Additionally, such malformed requests may cause a Denial of Service (DoS) by triggering an RPC GARBAGE_ARGS reply.
Statement
An input validation flaw in the NFSv2 server sattr decoder allows out-of-range useconds values to be converted to nanoseconds before the raw range is checked. On 32-bit ILP32 systems the tmp2 * NSEC_PER_USEC multiplication can wrap and produce an apparently valid tv_nsec value, so malformed SETATTR or CREATE RPCs may be accepted with incorrect timestamp data. The atime handling also missed the Sun server time convention for useconds 1000000, allowing an invalid one second nanosecond value to reach filesystem code in some requests. For the CVSS the PR:N is used for the paranoid network exposed case where an attacker can send NFSv2 RPCs to a writable or anonymous export without local privileges on the server. The issue is network reachable only when nfsd serves NFSv2 to an attacker reachable export. Impact is primarily low integrity impact to file timestamp metadata, with no clear memory corruption or privilege escalation primitive.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 8.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | High |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
