Linux NFSD: NFSv2 SETATTR/CREATE useconds wrap to a bogus tv_nsec on 32-bit servers

Impact

The NFSv2 sattr decoder multiplies a u32 useconds value by NSEC_PER_USEC into an unsigned long. On ILP32 that is 32 bits, so an out-of-range value such as 4294968 wraps and yields a small in-range tv_nsec - corruption that happens during decode, before any proc function can range-check it. A second issue is real on all word sizes: the Sun 'set to current server time' convention (useconds == 1000000) was only honoured in the mtime block, so a client putting it in the atime field alone pushed an out-of-range tv_nsec of 10^9 to the filesystem with ATTR_ATIME_SET still set. Impact is timestamp integrity on NFS-exported data, not code execution. Practically this is near-unreachable on a datacenter fleet: it needs a 32-bit kernel and NFSv2 enabled on the export, neither of which is normal on a GPU node's storage tier.

Who can reach it

An NFS client sending a v2 SETATTR or CREATE with an out-of-range useconds field, against a server that still serves NFSv2. The wrap itself requires a 32-bit (ILP32) kernel; the atime Sun-convention bug does not.

What to do

Apply the stable fix, which rejects useconds greater than 1000000 in the decoder and applies the Sun convention symmetrically in the atime block, and reboot the node. Disabling NFSv2 on exports removes exposure without a reboot and is the right answer for most fleets anyway. No fixed version is stated in the record.

References

Related entries

• Linux NFSD: bogus WARN_ON_ONCE fires on NFS re-export lookupsCVE-2026-89711 · Linux kernel NFSD (nfsd_mode_check WARN_ON_ONCE, NFS re-export)High
• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel NVMe target authentication (nvmet-auth DH group setup): CtrlCVE-2024-50215 · Linux kernel NVMe target authentication (nvmet-auth DH group setup)High
• OpenSSH (sshd): regreSSHion: signal-handler race in sshd giving unauthenticated remote root on glibc LinuxCVE-2024-6387 · OpenSSH (sshd)High