{"id":21635,"date":"2026-09-12T04:31:27","date_gmt":"2026-09-11T20:31:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89713"},"modified":"2026-09-12T04:31:27","modified_gmt":"2026-09-11T20:31:27","slug":"cve-2026-89713","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89713","title":{"rendered":"CVE-2026-89713 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>NFSD: check truncate permission under inode lock<\/p>\n<p>nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC<br \/>\nbefore it takes inode_lock(). The comparison uses the file size sampled<br \/>\nby that unlocked read, but the actual ATTR_SIZE update is applied later<br \/>\nunder inode_lock() by notify_change().<\/p>\n<p>This leaves a TOCTOU window for append-only files. If a client sends a<br \/>\nSETATTR that does not shrink the file at the time of the unlocked<br \/>\nsample, a concurrent append can extend the file before nfsd_setattr()<br \/>\ntakes inode_lock(). notify_change() then applies a real truncation<br \/>\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS<br \/>\ntruncate syscall paths perform their own append-only checks before<br \/>\ncalling notify_change(), so NFSD must make this decision against the<br \/>\nlocked size it is about to change.<\/p>\n<p>Split the write-count acquisition from the truncation permission check.<br \/>\nKeep get_write_access() before the locked setattr work, then recheck<br \/>\nwhether the requested size is below i_size_read(inode) after inode_lock()<br \/>\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids<br \/>\nthe plain unlocked inode-&gt;i_size load.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>NFSD: check truncate permission under inode lock<\/p>\n<p>nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC<br \/>\nbefore it takes <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21635","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}