Linux NFSD: TOCTOU lets a SETATTR truncate an append-only file

Impact

nfsd_setattr() decides whether a size change needs NFSD_MAY_TRUNC using an unlocked read of i_size, then applies ATTR_SIZE later under inode_lock. A concurrent append can extend the file inside that window, so notify_change() performs a real truncation that never went through the IS_APPEND() rejection the VFS truncate paths enforce. For an operator the consequence is integrity, not code execution: append-only files on an NFS export - audit trails, job logs, checkpoint journals written by training runs - can be shortened by a client that should not be able to shorten them. Affects any host exporting NFS where append-only immutability is relied on.

Who can reach it

Any NFS client that can send SETATTR to an export, racing an append to the same file. Authentication is whatever the export requires; no local access on the server.

What to do

Apply the stable fix, which rechecks the requested size against i_size after inode_lock and before notify_change(), and reboot the NFS server node. No configuration mitigation short of removing append-only reliance on NFS-exported files. The record names stable commits only, not a released version.

References

Related entries

• Linux kernel qla2xxx: unbounded rsp_info_len underflows sense length and leaks adjacent kernel memoryCVE-2026-89846 · Linux kernel scsi qla2xxx (FCP response rsp_info_len bound)Critical
• Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slabCVE-2026-90011 · Linux kernel iSCSI target (login payload buffer, MAX_KEY_VALUE_PAIRS)Critical
• Linux kernel nvmet: unvalidated transfer length and halen/dhlen cause heap out-of-bounds read in CHAP negotiateCVE-2026-90230 · Linux kernel nvmet (NVMe-oF target DH-HMAC-CHAP negotiate path)Critical
• Linux kernel IB/isert: login PDU declaring more data than received over-reads the 8KB login bufferCVE-2026-90413 · Linux kernel IB/isert (iSER login PDU DataSegmentLength validation)Critical
• Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to theCVE-2026-90414 · Linux kernel IB/isert (full-feature-phase PDU byte_len validation)Critical
• KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejectedCVE-2026-64106 · Linux kernel KVM arm64 vgic-its (vgic_its_restore_dte num_eventid_bits validation)Critical