Linux kernel nfsd: broken short-write detection writes the next segment at the wrong file offset

Impact

The partial-write check compares the bytes written against the already-advanced residual count, so the loop only breaks when less than half a segment was written. Any short write between 50% and 99% slips through: the next segment is written at an offset that was only bumped by the short amount, and the byte count reported to the client is too high. This is silent data corruption on the server side, and it is the one entry in this batch scored for integrity rather than availability. On a GPU fleet the files at risk are checkpoints and dataset shards - corruption that surfaces days later as a failed restore, not as an alert.

Who can reach it

No attacker is required; it triggers whenever a write on the NFS server's direct-I/O path completes short. Any NFS client writing to an affected export can be the one whose data lands wrong. Authentication is whatever the export requires.

What to do

Update the host kernel to a stable release that snapshots the segment byte count before the write, then reboot the NFS server. If the fleet ran an affected kernel under load, verify checksums on checkpoints and datasets written in that period - the corruption is silent and patching does not repair already-written files.

References

Related entries

• Linux kernel nfsd: NFSv4 SETATTR with the special ONE stateid NULL-derefs and oopses the serverCVE-2026-89679 · Linux kernel nfsd4_setattr() (NFSv4 delegated timestamp attributes)High
• Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mountCVE-2026-89680 · Linux kernel nfsd4_copy() (inter-server COPY setup error path)High
• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High
• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High