GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89706 (GCVE-0-2026-89706)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
nfsd: Reset write verifier when async COPY writeback fails
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writeverf at request time and reports it to the client via CB_OFFLOAD after the worker kthread completes. When the post-copy vfs_fsync_range() or filemap_check_wb_err() in _nfsd_copy_file_range() reports an error, the worker correctly leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes wr_stable_how as NFS_UNSTABLE, but the server's write verifier is not rotated. A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with COMMIT to make the copied data durable. With the verifier unchanged, COMMIT returns the same value the client just received via CB_OFFLOAD, and the client concludes the copy is durable -- silently dropping the data whose writeback in fact failed. This violates the UNSTABLE+COMMIT durability contract (RFC 7862 section 15.1, RFC 8881 section 18.32) and matches the bug just fixed in nfsd_vfs_write() and nfsd_commit(). Rotate nn->writeverf at the writeback-failure site. The async COPY worker has no svc_rqst, so commit_reset_write_verifier() is not available here; calling nfsd_reset_write_verifier() directly mirrors the trace-less reset already used by nfsd_file_check_write_error() for the same purpose. Filter out -EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since neither indicates a durable-storage failure.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 817c6eb975798647c4bbbfc9eb288aa413ec7f65 , < cc5f7cef0659a27c13dd33edd8e2f79257b095c6 (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7 (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < 8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < 6b13d26cc21b6320a3c61d5e4cee2ce9a589b181 (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < 31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0 (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < 591134e059e3456180244a826d6917cdc183140b (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < bf0cd31a9abcb728c17d79b4c2cc533612a8b6af (git)
Affected: eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d , < f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9 (git)
Affected: 5.10.220 , < 5.10.270 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc5f7cef0659a27c13dd33edd8e2f79257b095c6",
              "status": "affected",
              "version": "817c6eb975798647c4bbbfc9eb288aa413ec7f65",
              "versionType": "git"
            },
            {
              "lessThan": "c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "6b13d26cc21b6320a3c61d5e4cee2ce9a589b181",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "591134e059e3456180244a826d6917cdc183140b",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "bf0cd31a9abcb728c17d79b4c2cc533612a8b6af",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9",
              "status": "affected",
              "version": "eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.220",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.220",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Reset write verifier when async COPY writeback fails\n\nAsync COPY captures nn-\u003ewriteverf at request time and reports it to\nthe client via CB_OFFLOAD after the worker kthread completes. When\nthe post-copy vfs_fsync_range() or filemap_check_wb_err() in\n_nfsd_copy_file_range() reports an error, the worker correctly\nleaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes\nwr_stable_how as NFS_UNSTABLE, but the server\u0027s write verifier is\nnot rotated.\n\nA client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with\nCOMMIT to make the copied data durable. With the verifier\nunchanged, COMMIT returns the same value the client just received\nvia CB_OFFLOAD, and the client concludes the copy is durable --\nsilently dropping the data whose writeback in fact failed. This\nviolates the UNSTABLE+COMMIT durability contract (RFC 7862 section\n15.1, RFC 8881 section 18.32) and matches the bug just fixed in\nnfsd_vfs_write() and nfsd_commit().\n\nRotate nn-\u003ewriteverf at the writeback-failure site. The async COPY\nworker has no svc_rqst, so commit_reset_write_verifier() is not\navailable here; calling nfsd_reset_write_verifier() directly\nmirrors the trace-less reset already used by\nnfsd_file_check_write_error() for the same purpose. Filter out\n-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since\nneither indicates a durable-storage failure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd\u0027s NFSv4.2 async COPY worker (_nfsd_copy_file_range), reached by sending a COMPOUND with OP_COPY (ca_synchronous=false) to the in-kernel NFS server over TCP/2049. No local access to the server is required.\nAC:L - A client can induce the writeback-failure path by filling the export or hitting quota so vfs_fsync_range()/filemap_check_wb_err() returns ENOSPC/EDQUOT after the copy dirties pages, then issue async COPY; CB_OFFLOAD UNSTABLE plus COMMIT with an unchanged verifier is the specified client sequence and needs no race.\nPR:N - Default nfsd deployments use AUTH_SYS/AUTH_NULL with IP-based exports and no cryptographic authentication, so any host allowed by the export can EXCHANGE_ID/CREATE_SESSION, OPEN source and destination files, and issue async COPY by asserting a uid.\nUI:N - The attacking NFS client issues COPY, receives CB_OFFLOAD, and sends COMMIT itself. No administrator or end-user action on the NFS server is required beyond nfsd already serving an NFSv4.2 export.\nS:U - Silent durability failure affects file data on the exported filesystem in the same kernel security authority as nfsd. This is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:N - The defect only skips rotating nn-\u003ewriteverf after a failed COPY fsync; it does not read out-of-bounds, leak kernel memory, or disclose file contents beyond ordinary NFS access.\nI:H - vfs_fsync_range() consumes the writeback error, COMMIT then returns the same verifier, and the client drops the UNSTABLE copy as durable, silently discarding destination file data. Entire COPY ranges, including whole-file copies, can be lost while applications treat them as persisted.\nA:N - The missing verifier rotation does not oops, panic, deadlock, or hang nfsd; the server continues serving RPCs. Impact is incorrect durability reporting and data loss, not loss of the NFS service itself."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:07.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc5f7cef0659a27c13dd33edd8e2f79257b095c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b13d26cc21b6320a3c61d5e4cee2ce9a589b181"
        },
        {
          "url": "https://git.kernel.org/stable/c/31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/591134e059e3456180244a826d6917cdc183140b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf0cd31a9abcb728c17d79b4c2cc533612a8b6af"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9"
        }
      ],
      "title": "nfsd: Reset write verifier when async COPY writeback fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89706",
    "datePublished": "2026-09-11T19:46:22.561Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-09-14T12:02:07.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89706",
      "date": "2026-09-15",
      "epss": "0.00511",
      "percentile": "0.42161"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89706\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:57.890\",\"lastModified\":\"2026-09-14T13:19:20.523\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: Reset write verifier when async COPY writeback fails\\n\\nAsync COPY captures nn-\u003ewriteverf at request time and reports it to\\nthe client via CB_OFFLOAD after the worker kthread completes. When\\nthe post-copy vfs_fsync_range() or filemap_check_wb_err() in\\n_nfsd_copy_file_range() reports an error, the worker correctly\\nleaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes\\nwr_stable_how as NFS_UNSTABLE, but the server\u0027s write verifier is\\nnot rotated.\\n\\nA client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with\\nCOMMIT to make the copied data durable. With the verifier\\nunchanged, COMMIT returns the same value the client just received\\nvia CB_OFFLOAD, and the client concludes the copy is durable --\\nsilently dropping the data whose writeback in fact failed. This\\nviolates the UNSTABLE+COMMIT durability contract (RFC 7862 section\\n15.1, RFC 8881 section 18.32) and matches the bug just fixed in\\nnfsd_vfs_write() and nfsd_commit().\\n\\nRotate nn-\u003ewriteverf at the writeback-failure site. The async COPY\\nworker has no svc_rqst, so commit_reset_write_verifier() is not\\navailable here; calling nfsd_reset_write_verifier() directly\\nmirrors the trace-less reset already used by\\nnfsd_file_check_write_error() for the same purpose. Filter out\\n-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since\\nneither indicates a durable-storage failure.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"817c6eb975798647c4bbbfc9eb288aa413ec7f65\",\"lessThan\":\"cc5f7cef0659a27c13dd33edd8e2f79257b095c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"6b13d26cc21b6320a3c61d5e4cee2ce9a589b181\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"591134e059e3456180244a826d6917cdc183140b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"bf0cd31a9abcb728c17d79b4c2cc533612a8b6af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eac0b17a77fbd763d305a5eaa4fd1119e5a0fe0d\",\"lessThan\":\"f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.220\",\"lessThan\":\"5.10.270\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/31d4d0a62ec4bafbcdbad142f11ab1f90794b1d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/591134e059e3456180244a826d6917cdc183140b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b13d26cc21b6320a3c61d5e4cee2ce9a589b181\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8a08ffe73eb2aa6bc6f88763da7e2b55bab6493a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf0cd31a9abcb728c17d79b4c2cc533612a8b6af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c6d2f6372c7e0f76b9c148ff7696aec64da0b5b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc5f7cef0659a27c13dd33edd8e2f79257b095c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T05:50:14+00:00",
      "cve": "CVE-2026-89706",
      "id": "CVE-2026-89706",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: Reset write verifier when async COPY writeback fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89706.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T23:59:45Z",
      "cve": "CVE-2026-89706",
      "id": "CVE-2026-89706",
      "initial_release_date": "2026-09-15T23:59:45Z",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89706",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89706.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.