Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durable

Impact

_nfsd_copy_file_range() sampled dst->f_wb_err after the copy loop. Because the nfsd file cache shares one struct file per inode, a concurrent COMMIT or stable WRITE can advance the cursor first, so the COPY worker sees no error, sets NFSD4_COPY_F_COMMITTED, and CB_OFFLOAD encodes FILE_SYNC4. The client then treats data whose writeback actually failed as durable - silent data loss with no error surfaced anywhere. On a GPU fleet the exposure is checkpoints and dataset copies performed server-side: a job resumes from a checkpoint that was never written. Integrity impact, not a crash, which is why it is easy to miss in monitoring.

Who can reach it

Not an attack in the usual sense - it is triggered by concurrent NFSv4.2 COPY and COMMIT/WRITE traffic from ordinary authenticated clients against the same file, combined with a real storage writeback failure. No special privileges are needed.

What to do

Update the NFS server kernel to a build with the fix (stable commits 20a67a7d1822, 52b2db7a72e1, 8277d4a11ae2, a1cbafe756cd) and reboot the node. There is no mitigation short of the patch; disabling NFSv4.2 server-side copy on clients avoids the path but is a client-side workaround only. Where writeback errors have occurred on an affected server, treat server-side-copied checkpoints from that window as unverified.

References

Related entries

• Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost dataCVE-2026-89706 · Linux kernel nfsd (async COPY write verifier rotation, nn->writeverf)High
• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
• HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High
• Harbor registry: P2P preheat execution logs readable/updatable by any authenticated user via job ID enumerationCVE-2022-31671 · Harbor registryHigh