kernel: nfsd: fix partial-write detection in nfsd_direct_write (CVE-2026-89678)

Overview

A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The nfsd_direct_write() function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic for detecting short writes compares the actual bytes written against a residual count rather than the original requested length. As a result, partial writes between 50% and 99% of the intended size are not properly identified, leading to subsequent data being written at incorrect file offsets and the NFS client receiving an inaccurate report of bytes written. This can allow a remote attacker to cause data corruption on the NFS server.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10 · updated 2026-10-21 · vex

kernel: nfsd: fix partial-write detection in nfsd_direct_write — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-10-21.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6

No fix planned:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 10

Not affected:

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Remediation

Out of support scope

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.