{"id":"CVE-2026-89706","summary":"nfsd: Reset write verifier when async COPY writeback fails","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Reset write verifier when async COPY writeback fails\n\nAsync COPY captures nn-\u003ewriteverf at request time and reports it to\nthe client via CB_OFFLOAD after the worker kthread completes. When\nthe post-copy vfs_fsync_range() or filemap_check_wb_err() in\n_nfsd_copy_file_range() reports an error, the worker correctly\nleaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes\nwr_stable_how as NFS_UNSTABLE, but the server's write verifier is\nnot rotated.\n\nA client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with\nCOMMIT to make the copied data durable. With the verifier\nunchanged, COMMIT returns the same value the client just received\nvia CB_OFFLOAD, and the client concludes the copy is durable --\nsilently dropping the data whose writeback in fact failed. This\nviolates the UNSTABLE+COMMIT durability contract (RFC 7862 section\n15.1, RFC 8881 section 18.32) and matches the bug just fixed in\nnfsd_vfs_write() and nfsd_commit().\n\nRotate nn-\u003ewriteverf at the writeback-failure site. The async COPY\nworker has no svc_rqst, so commit_reset_write_verifier() is not\navailable here; calling nfsd_reset_write_verifier() directly\nmirrors the trace-less reset already used by\nnfsd_file_check_write_error() for the same purpose. Filter out\n-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since\nneither indicates a durable-storage failure.","modified":"2026-11-13T04:00:41.160004663Z","published":"2026-09-11T19:46:22.561Z","related":["SUSE-SU-2026:24179-1","SUSE-SU-2026:24184-1","SUSE-SU-2026:24197-1","SUSE-SU-2026:24235-1","SUSE-SU-2026:24371-1","SUSE-SU-2026:24379-1","SUSE-SU-2026:24473-1","SUSE-SU-2026:24550-1","SUSE-SU-2026:24553-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:4935-1","SUSE-SU-2026:4940-1","SUSE-SU-2026:5091-1","openSUSE-SU-2026:11880-1","openSUSE-SU-2026:22091-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89706.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/591134e059e3456180244a826d6917cdc183140b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6b13d26cc21b6320a3c61d5e4cee2ce9a589b181"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bf0cd31a9abcb728c17d79b4c2cc533612a8b6af"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc5f7cef0659a27c13dd33edd8e2f79257b095c6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89706.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89706"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"817c6eb975798647c4bbbfc9eb288aa413ec7f65"},{"fixed":"cc5f7cef0659a27c13dd33edd8e2f79257b095c6"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d"},{"fixed":"c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7"},{"fixed":"8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a"},{"fixed":"6b13d26cc21b6320a3c61d5e4cee2ce9a589b181"},{"fixed":"31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0"},{"fixed":"591134e059e3456180244a826d6917cdc183140b"},{"fixed":"bf0cd31a9abcb728c17d79b4c2cc533612a8b6af"},{"fixed":"f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9"}]}],"versions":["v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89706.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.220"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89706.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}