Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to disk

Impact

The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds straight into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has that check; the TIME_DELEG paths did not. A client sending a malformed timespec gets it through notify_change() and onto disk, where the out-of-range value then has to be handled by every consumer of that inode's timestamps. The record describes corruption of on-disk timestamp values, not memory corruption or a privilege gain, so the operational effect is bad metadata on a shared export rather than a compromise. The fix adds range checks in both nfs4xdr.c on the SETATTR path and nfs4callback.c on the CB_GETATTR path.

Who can reach it

Any authenticated NFSv4 client that can issue SETATTR with a time delegation attribute against the export. No server-side privilege required.

What to do

Patch the kernel on in-kernel NFS server nodes and reboot. Low urgency - fold it into the next scheduled kernel roll. Timestamps already written out of range are not corrected by the patch.

References

Related entries

• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored
• Linux NFS localio: reference leak on nfs_uuid_add_file failure pins an nfsd_file and blocks netns teardownCVE-2026-89715 · Linux kernel NFS localio (nfs_open_local_fh error path, nfs_uuid_add_file)Unscored
• KVM arm64 vGICv2: guest write of an out-of-range GICV_DIR INTID triggers a host WARN and panics panic_on_warn hostsCVE-2026-89727 · Linux kernel KVM arm64 vGICv2 (GICV_DIR INTID handling)Unscored
• Linux x86/tdx: off-by-one GENMASK makes the port I/O value mask one bit too wide in a TDX guestCVE-2026-89751 · Linux kernel x86/tdx (handle_in/handle_out port I/O mask)Unscored
• Linux memcg: concurrent memory.max writers reclaim toward a stale target and can loop indefinitelyCVE-2026-89752 · Linux kernel memcg (memory.high / memory.max writer reclaim loop)Unscored
• Linux mm/vmscan: direct reclaim never reports an RCU-tasks quiescent state, stalling rcu_tasks under memory pressureCVE-2026-89753 · Linux kernel mm/vmscan (shrink_lruvec RCU-tasks quiescent state)Unscored