Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write reference

Impact

In the BOTH_TIME_SET branch, fh_verify() is called early so setattr_prepare() can inspect the dentry, which makes nfsd_setattr() skip fh_want_write(). notify_change() then runs with no mount write reference, bypassing the freeze/remount-read-only protection that reference exists to provide. Practically this means an NFSv2 attribute change can modify a filesystem while it is being frozen or has been remounted read-only - an integrity and consistency problem for snapshot and backup workflows on shared storage nodes, not a path to code execution. The record gives no detail beyond the missing call, and NFSv2 is off or unused on most modern exports.

Who can reach it

An NFS client able to send a v2 SETATTR with both time fields set, against a server that still enables NFSv2. Export-level authentication applies; no local access needed.

What to do

Apply the stable fix adding the missing fh_want_write() after the early fh_verify(), and reboot the NFS server node. Disabling NFSv2 on the export removes exposure without a reboot. No fixed version is stated in the record.

References

Related entries

• Linux NFSD: TOCTOU lets a SETATTR truncate an append-only fileCVE-2026-89713 · Linux kernel NFSD (nfsd_setattr ATTR_SIZE truncate permission check)Critical
• Linux kernel qla2xxx: unbounded rsp_info_len underflows sense length and leaks adjacent kernel memoryCVE-2026-89846 · Linux kernel scsi qla2xxx (FCP response rsp_info_len bound)Critical
• Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slabCVE-2026-90011 · Linux kernel iSCSI target (login payload buffer, MAX_KEY_VALUE_PAIRS)Critical
• Linux kernel nvmet: unvalidated transfer length and halen/dhlen cause heap out-of-bounds read in CHAP negotiateCVE-2026-90230 · Linux kernel nvmet (NVMe-oF target DH-HMAC-CHAP negotiate path)Critical
• Linux kernel IB/isert: login PDU declaring more data than received over-reads the 8KB login bufferCVE-2026-90413 · Linux kernel IB/isert (iSER login PDU DataSegmentLength validation)Critical
• Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to theCVE-2026-90414 · Linux kernel IB/isert (full-feature-phase PDU byte_len validation)Critical