PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89697 Linux CVE debrief

A vulnerability in the Linux kernel's nfsd_proc_setattr() function has been addressed. The BOTH_TIME_SET branch calls fh_verify() early, causing nfsd_setattr() to skip fh_want_write(), and notify_change() runs without a mount write reference. A missing fh_want_write() call has been added after the early fh_verify(). This change ensures proper acquisition of a mount write reference, preventing potential issues. Linux administrators should review and verify patch deployment to ensure system security.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-19
Advisory published
2026-09-11
Advisory updated
2026-10-19

Who should care

Linux administrators and users of affected Linux kernel versions should assess exposure and prioritize patch deployment to ensure system security. Verifying patch deployment is crucial to prevent exploitation. Linux kernel updates and advisories should be monitored to ensure timely patch deployment.

Why it matters

Linux administrators should assess exposure and prioritize patch deployment for this Linux kernel vulnerability. The vulnerability has been addressed, but verifying patch deployment is crucial.

  • Verify Linux kernel versions and patch deployment
  • Assess exposure and prioritize Linux kernel updates

Technical summary

The Linux kernel's nfsd_proc_setattr() function did not properly acquire a mount write reference in the BOTH_TIME_SET branch, leading to a vulnerability. A fix has been applied by adding a missing fh_want_write() call. This change ensures that notify_change() runs with a mount write reference, preventing potential issues. Linux administrators should assess exposure and prioritize patch deployment to ensure system security. The vulnerability has been addressed, but verifying patch deployment is crucial to prevent exploitation.

Defensive priority

Linux administrators should assess exposure and verify patch deployment, prioritizing Linux kernel updates.

Recommended defensive actions

  • Assess Linux kernel versions for exposure
  • Verify and deploy patches for affected Linux kernel versions
  • Monitor Linux kernel updates and advisories
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. Multiple source references from the Linux kernel Git repository are also available. The vulnerability has been addressed in the Linux kernel, and patch deployment is recommended. Defenders should verify patch deployment and assess exposure to ensure system security.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89697 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89697

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89697 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89697

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89697.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.