Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:56.843Z",
  "pubdate": "2026-09-11T20:19:56.843Z",
  "executiveSummary": "This vulnerability involves a missing mount write reference in the Linux kernel nfsd component during early-verified SETATTR operations.\nThe flaw originates from the nfsd_proc_setattr function, where the BOTH_TIME_SET branch triggers an early fh_verify() call, subsequently bypassing the mandatory fh_want_write() execution.\nWithout a proper mount write reference, the kernel executes notify_change() in an unsafe context, potentially leading to filesystem inconsistencies or kernel instability.\nThe vulnerability affects systems utilizing the NFSv4 or similar nfsd implementations within the Linux kernel.\nAn attacker capable of triggering a SETATTR request that hits the BOTH_TIME_SET branch could induce a write operation on a filesystem lacking the required synchronization protections.\nThis represents a significant reliability and security risk, as it permits unauthorized or unreferenced metadata modifications during the attribute setting process, potentially bypassing VFS-level filesystem protections.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sequence of state management within nfsd_proc_setattr when handling specific file handle attributes.\nIn the Linux kernel's NFS daemon implementation, write operations on a filesystem require an explicit write reference to ensure that the underlying mount point remains writable and consistent during metadata changes. This is managed via the fh_want_write() helper function.\nWithin nfsd_proc_setattr, certain code paths—specifically the branch labeled BOTH_TIME_SET—necessitate an early call to fh_verify() to validate the file handle and inspect the associated dentry. This inspection is required by setattr_prepare() to verify the validity of the requested attributes before proceeding with the operation.\nHowever, the architecture of the function is such that after the early fh_verify() call, the subsequent execution flow skips the necessary call to fh_want_write(). Consequently, when notify_change() is invoked to apply the requested attribute modifications, the kernel operates without having successfully obtained or registered the mount write reference.\nThe exploitation flow involves the following sequence: 1) A remote client sends an NFS SETATTR request, specifically targeting attributes that trigger the BOTH_TIME_SET conditional path. 2) The nfsd server executes fh_verify() early, successfully validating the dentry for setattr_prepare(). 3) Because the flow neglects to trigger fh_want_write(), the operation proceeds to notify_change() without the VFS being aware that a write operation is occurring on the mount. 4) The lack of this reference can lead to inconsistent state management, potentially allowing metadata updates to occur on read-only mounts or bypassing specific filesystem security checks enforced by the VFS write-tracking mechanism.\nThis logic error effectively decouples the attribute modification process from the kernel's internal write-safety infrastructure. While the primary impact is likely filesystem metadata instability, such vulnerabilities can often be leveraged to violate filesystem integrity assumptions, providing a vector for further privilege escalation or denial-of-service conditions through kernel panic when the VFS detects an illegal write state."
}