Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost data

Impact

When an async server-side COPY hits a writeback error, nfsd correctly reports NFS_UNSTABLE in CB_OFFLOAD but does not rotate the server write verifier. The client's follow-up COMMIT returns the same verifier it already holds, so the client concludes the copy is durable and drops the data whose writeback failed. That breaks the UNSTABLE+COMMIT durability contract in RFC 7862 and RFC 8881 and turns a detected storage failure into silent data loss. For GPU operators the practical case is checkpoint and dataset copies on shared NFS: a job restarts from a checkpoint the storage never persisted. Related to but distinct from the cursor-sampling bug in the same function.

Who can reach it

No attacker required. Any authenticated NFSv4.2 client using server-side COPY hits this whenever the server's writeback to durable storage fails.

What to do

Update the NFS server kernel to a build that rotates the verifier at the writeback-failure site (stable commits 31d4d0a62ec4, 591134e059e3, bf0cd31a9abc, f5cb2276954c) and reboot the node. No runtime mitigation exists; avoiding client-side use of NFSv4.2 server-side copy sidesteps the path. Re-verify checkpoints copied during any period when the server logged writeback errors.

References

Related entries

• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
• HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High
• Harbor registry: P2P preheat execution logs readable/updatable by any authenticated user via job ID enumerationCVE-2022-31671 · Harbor registryHigh
• MinIO (admin server-update API): An authenticated request to the server-update admin API traverses out of the intendedCVE-2022-35919 · MinIO (admin server-update API)High