Към съдържанието
Търсене

CVE-2026-89666: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on the wire and decodes cleanly into a valid uint32, but it is not a valid timespec64: tv_nsec must be less than NSEC_PER_SEC. Nothing in the setattr path clamps it. notify_change() runs the time through timestamp_truncate(), which does not reduce tv_nsec below NSEC_PER_SEC when the filesystem supports nanosecond granularity (s_time_gran == 1), and the inode atime/mtime setters store it verbatim (only ctime is normalized, via inode_set_ctime_to_ts()). The un-normalized value then corrupts on-disk metadata: ext4's ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which overflows the 32-bit extra field and clobbers the seconds-epoch bits, so the stored seconds (and thus the year) are wrong on read-back. XFS with bigtime mis-stores the timestamp for the same reason. Validate the client-supplied atime/mtime in the proc handlers and return NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL for SETATTR and describes it as the error for a value the server 'can not store ... in its own representation'; the client maps it to EINVAL. Checking in the proc handlers, rather than in nfsd_setattr(), keeps the rejection in front of object creation. The create operations create the object before nfsd_create_setattr() runs, so a late failure would leave the new object behind and turn a non-idempotent request into a namespace change that reports failure. The check is therefore done up front, for the create operations before the object is created. tv_nsec is a long, so the comparison casts it to unsigned long (the same width) rather than to u32, matching timespec64_valid(). A u32 cast would truncate on 64-bit; the unsigned long cast also rejects a value that

    Засегнати продукти

    • Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди cacda0762d7af24a27f7265711bc05095ece56b9; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 98fc1d21a7b80324ba64b949ac6bcc00364dd068; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 55341d8a5a0f5853e70d46f5a55cf06007808f1d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 54e02f5e32c52fb395f2ee02986a6c6d5608d22b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди e2543852152bcf9aeb57da17d9f9219f7df8aafb; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди eb0eca7720662ba5847df1510e73801f7f473094
    • Linux Linux: 2.6.12; преди 2.6.12; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; 7.3 до *

    История

    • 11 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89666: Linux | freedomonline.bg