CVE-2026-89665

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

The NFSv2 sattr decoder converts the wire useconds to nanoseconds in

svcxdr_decode_sattr():

iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;

tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in

unsigned long. On ILP32 that is 32 bits, and an out-of-range useconds

value such as 4294968 wraps to tv_nsec == 704. The corruption therefore

happens during decode, before any proc function can inspect the value,

and a later range check on tv_nsec would see an in-range result and

accept it. Rejecting in the decoder yields an RPC GARBAGE_ARGS reply.

NFSv2 defines no NFSERR_INVAL, so there is no NFS-level status to return

for a malformed time argument, and the check cannot move to the proc

function the way the v3/v4 nsec range checks do.

Guard the raw useconds before the multiplication and reject values

greater than 1000000. useconds == 1000000 is kept

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References