VDB

CVE-2026-89697

CVE-2026-89697 PUBLISHED CVSS 9.1 CRITICAL

Reported by Linux · Published September 11, 2026

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

EPSS 0.69% · 51.2th percentile

Risk Scores

CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score
0.69%
51.2th percentile

Affected Products

VendorProductVersions
LinuxLinuxcc265089ce1b176dde963c74b53593446ee7f99a, cc265089ce1b176dde963c74b53593446ee7f99a, cc265089ce1b176dde963c74b53593446ee7f99a
LinuxLinux4.2, 0, 5.10.270
LinuxLinux7.3-rc1, cc265089ce1b176dde963c74b53593446ee7f99a, cc265089ce1b176dde963c74b53593446ee7f99a
linuxlinux_kernel4.2, 4.2, 4.2

Timeline

  • Sep 11, 2026 Coalition ESS Score
  • Sep 11, 2026 CVE Published
  • Sep 12, 2026 EPSS Score
  • Sep 13, 2026 EPSS Score
  • Sep 14, 2026 CVE Updated
  • Sep 15, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›