CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
A race condition in the Linux kernel NFS server allows bypassing mount write references, potentially leading to privilege escalation or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89697?
CVE-2026-89697 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference.
Add the missing fh_want_write() call after the early fh_verify().
Which versions are affected by CVE-2026-89697?
How do I fix CVE-2026-89697?
Apply the vendor's patch.
Is CVE-2026-89697 being exploited?
There is no known exploitation of CVE-2026-89697 in the wild and no public exploit code.
Sources
Also known as AZL-100325, BELL-CVE-2026-89697, DEBIAN-CVE-2026-89697, GHSA-36mf-r537-f6c6, UBUNTU-CVE-2026-89697.