PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89665 Linux CVE debrief

A vulnerability in the Linux kernel's nfsd could allow an attacker to corrupt the atime field during decode, before any proc function can inspect the value. The issue arises from the conversion of wire useconds to nanoseconds in svcxdr_decode_sattr() for NFSv2 SETATTR/CREATE operations. An out-of-range useconds value can wrap to an in-range tv_nsec value, which would then be accepted by a later range check. To address this, the decoder rejects values greater than 1000000, as useconds == 1000000 is a Sun convention for 'set to the current server time'.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-19
Advisory published
2026-09-11
Advisory updated
2026-10-19

Who should care

Defenders responsible for Linux kernel security, particularly those managing NFSv2 operations, should assess exposure and prioritize patching affected versions. This vulnerability could lead to unintended atime field modifications.

Why it matters

CVE-2026-89665 is a vulnerability in the Linux kernel's nfsd that could allow an attacker to corrupt the atime field. Defenders should prioritize verifying and applying patches, monitoring and restricting unusual useconds values, and reviewing Linux kernel configurations.

  • Verify and restrict unusual useconds values in NFSv2 traffic to prevent potential atime field corruption
  • Prioritize patching affected Linux kernel versions to prevent exploitation
  • Monitor for and respond to potential modifications to the atime field

Technical summary

The Linux kernel's nfsd is vulnerable to a corruption issue in the atime field during decode of NFSv2 SETATTR/CREATE operations. An out-of-range useconds value can wrap to an in-range tv_nsec value, which would then be accepted. The decoder now rejects values greater than 1000000. This vulnerability could allow an attacker to corrupt the atime field. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those providing NFSv2 SETATTR/CREATE operations. They should also monitor for and restrict unusual useconds values in NFSv2 traffic.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those providing NFSv2 SETATTR/CREATE operations. They should also monitor for and restrict unusual useconds values in NFSv2 traffic.

Recommended defensive actions

  • Verify and apply patches for Linux kernel versions affected by CVE-2026-89665
  • Monitor and restrict unusual useconds values in NFSv2 traffic
  • Review and update Linux kernel configurations to prevent exploitation
  • Perform vulnerability scanning to identify exposed systems
  • Implement compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Review audit logs for potential security incidents

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental source references include multiple Linux kernel commit hashes related to the vulnerability fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89665 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89665

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89665 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89665

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89665.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cdc3299f7072777b09c9582a3b8b65bb163ddcf3

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/09a79d9ab35a39603c834e8f6333603292f9c816

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5296a2442d12d45d6eea7b4d3ec3ffecc1821cac

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1db456ffc22e045f49f7b9e62415a26b3f33f200

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a937dd1aa2d92291fe0a1860d17e90d8f206cd22

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ad02d095439f89cbd6629420c7e3ba476457b83b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1195483965a5f63d2dde18054ec7e50a23b9071c

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.