CVE-2026-89666

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD

carrying an atime or mtime whose nseconds field is out of range. The

value is well-formed on the wire and decodes cleanly into a valid

uint32, but it is not a valid timespec64: tv_nsec must be less than

NSEC_PER_SEC.

Nothing in the setattr path clamps it. notify_change() runs the time

through timestamp_truncate(), which does not reduce tv_nsec below

NSEC_PER_SEC when the filesystem supports nanosecond granularity

(s_time_gran == 1), and the inode atime/mtime setters store it verbatim

(only ctime is normalized, via inode_set_ctime_to_ts()). The

un-normalized value then corrupts on-disk metadata: ext4's

ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which

overflows the 32-bit extra field and clobbers the seconds-epoch bits, so

the stored seconds (and thus the year) ar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References