Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFS

Impact

An NFSv3 client can send SETATTR, CREATE, MKDIR, SYMLINK or MKNOD with an atime or mtime whose nseconds field exceeds NSEC_PER_SEC. Nothing in the setattr path clamps it: timestamp_truncate() leaves it alone on nanosecond-granularity filesystems and the inode setters store it verbatim. ext4's ext4_encode_extra_time() then shifts tv_nsec into the 32-bit extra field, overflowing it and clobbering the seconds-epoch bits, so the stored year is wrong on read-back; XFS with bigtime mis-stores it the same way. Any tenant with write access to a shared dataset export can silently corrupt on-disk metadata that survives reboot and propagates into backups, and incremental sync tools that key on mtime will behave unpredictably afterwards.

Who can reach it

Any client that can mount the NFSv3 export with write permission. No server-local access needed; only normal export authentication applies.

What to do

Upgrade to a stable kernel containing the referenced commits and reboot the NFS server; drain or fail over clients first since knfsd cannot be restarted in place for a kernel fix. Already-corrupted timestamps are not repaired by the patch and must be found and corrected separately. The record names commits, not fixed release numbers.

References

Related entries

• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored
• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored
• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored
• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored
• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored
• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored