{"id":"CVE-2026-89697","title":"nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()\n\nThe BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()\ncan inspect the dentr…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-911"],"vendor":"Linux","product":"Linux","affected":["Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 3eec9d791968c177a4a8cda9af5c04f79dae09cb","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 9229d824b938f4fb0ea7a5dddade51735e6fe6f9","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 2150305134889fb2fc25228d35353bd2f6f29500","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < d823bf9285cdf4514873b85ab5a888878dd4e8f4","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 15ca3b64a69caa6194bed8f98a20ed90a11c11dd","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 533964d420d385e11b08dd4c56c66ef5dcccaf08","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < c4a409b86a92815181a8e9395c6bf1696ad19175","Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc","Linux 1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd8","Linux >= 3.18.46 < 3.19","Linux 4.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:26:07.202992Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:51:10.455Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89697","references":[{"url":"https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb"},{"url":"https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9"},{"url":"https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500"},{"url":"https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4"},{"url":"https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd"},{"url":"https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08"},{"url":"https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175"},{"url":"https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89697.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89697"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532144"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89697"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89697"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89697.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00696,"epssPercentile":0.52817,"scores":{"cna":9.1,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89697","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()\n\nThe BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()\ncan inspect the dentry. This causes nfsd_setattr() to skip\nfh_want_write(), so notify_change() runs without a mount write\nreference.\n\nAdd the missing fh_want_write() call after the early fh_verify().\n\n## Affected\n\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 3eec9d791968c177a4a8cda9af5c04f79dae09cb`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 9229d824b938f4fb0ea7a5dddade51735e6fe6f9`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 2150305134889fb2fc25228d35353bd2f6f29500`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < d823bf9285cdf4514873b85ab5a888878dd4e8f4`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 15ca3b64a69caa6194bed8f98a20ed90a11c11dd`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 533964d420d385e11b08dd4c56c66ef5dcccaf08`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < c4a409b86a92815181a8e9395c6bf1696ad19175`\n- `Linux >= cc265089ce1b176dde963c74b53593446ee7f99a < 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc`\n- `Linux 1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd8`\n- `Linux >= 3.18.46 < 3.19`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89697.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223238,"id":"CVE-2026-89697","ts":1792180027414,"field":"cvss","old":"7","new":"9.1"},{"seq":223237,"id":"CVE-2026-89697","ts":1792180027414,"field":"severity","old":"high","new":"critical"},{"seq":205524,"id":"CVE-2026-89697","ts":1789576723322,"field":"cvss","old":"9.1","new":"7"},{"seq":205523,"id":"CVE-2026-89697","ts":1789576723322,"field":"severity","old":"critical","new":"high"},{"seq":197726,"id":"CVE-2026-89697","ts":1789384318575,"field":"cvss","old":"6.8","new":"9.1"},{"seq":197725,"id":"CVE-2026-89697","ts":1789384318575,"field":"severity","old":"medium","new":"critical"},{"seq":183673,"id":"CVE-2026-89697","ts":1789356676889,"field":"cvss","old":"9.1","new":"6.8"},{"seq":183672,"id":"CVE-2026-89697","ts":1789356676889,"field":"severity","old":"critical","new":"medium"},{"seq":153580,"id":"CVE-2026-89697","ts":1789285351363,"field":"cvss","old":null,"new":"9.1"},{"seq":153579,"id":"CVE-2026-89697","ts":1789285351363,"field":"severity","old":"none","new":"critical"},{"seq":147768,"id":"CVE-2026-89697","ts":1789270212214,"field":"cvss","old":null,"new":"6.8"},{"seq":147767,"id":"CVE-2026-89697","ts":1789270212214,"field":"severity","old":"none","new":"medium"},{"seq":109506,"id":"CVE-2026-89697","ts":1789183732196,"field":"cvss","old":null,"new":"6.8"},{"seq":109505,"id":"CVE-2026-89697","ts":1789183732196,"field":"severity","old":"none","new":"medium"}]}