Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write reference

Impact

In the BOTH_TIME_SET branch, fh_verify() is called early so setattr_prepare() can inspect the dentry, which makes nfsd_setattr() skip fh_want_write(). notify_change() then runs with no mount write reference, bypassing the freeze/remount-read-only protection that reference exists to provide. Practically this means an NFSv2 attribute change can modify a filesystem while it is being frozen or has been remounted read-only - an integrity and consistency problem for snapshot and backup workflows on shared storage nodes, not a path to code execution. The record gives no detail beyond the missing call, and NFSv2 is off or unused on most modern exports.

Who can reach it

An NFS client able to send a v2 SETATTR with both time fields set, against a server that still enables NFSv2. Export-level authentication applies; no local access needed.

What to do

Apply the stable fix adding the missing fh_want_write() after the early fh_verify(), and reboot the NFS server node. Disabling NFSv2 on the export removes exposure without a reboot. No fixed version is stated in the record.

References

Related entries

• Linux NFSD: TOCTOU lets a SETATTR truncate an append-only fileCVE-2026-89713 · Linux kernel NFSD (nfsd_setattr ATTR_SIZE truncate permission check)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High