CVE-2026-89706

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to

the client via CB_OFFLOAD after the worker kthread completes. When

the post-copy vfs_fsync_range() or filemap_check_wb_err() in

_nfsd_copy_file_range() reports an error, the worker correctly

leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes

wr_stable_how as NFS_UNSTABLE, but the server's write verifier is

not rotated.

A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with

COMMIT to make the copied data durable. With the verifier

unchanged, COMMIT returns the same value the client just received

via CB_OFFLOAD, and the client concludes the copy is durable --

silently dropping the data whose writeback in fact failed. This

violates the UNSTABLE+COMMIT durability contract (RFC 7862 section

15.1, RFC 8881 section 18.32) and matches the bug just fixed in

nfsd_vfs_write() and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References