In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate nseconds in TIME_DELEG decode paths

The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms
store a raw uint32_t nseconds directly into tv_nsec without enforcing
nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this
check but the TIME_DELEG paths do not. A malformed timespec can
propagate through notify_change() to disk.

Add range checks in both nfs4xdr.c (SETATTR path) and
nfs4callback.c (CB_GETATTR path).

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
6ae30d6eb26bce02c48c60074b4306270e2434c1 affected < 7e7b93da7fa2e77f977096251899d1410986adf6
6ae30d6eb26bce02c48c60074b4306270e2434c1 affected < 5eb489831a9fd4754f4baf26e6989efb66ce104c
6ae30d6eb26bce02c48c60074b4306270e2434c1 affected < 0f4a767340fad392bd656115b8752005518c9065
Linux Linux affected
Version Status Constraints
6.14 affected —
0 unaffected < 6.14
6.18.50 unaffected ≤ 6.18.*
7.2.4 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0f4a767340fad392bd656115b8752005518c9065 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/5eb489831a9fd4754f4baf26e6989efb66ce104c cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/7e7b93da7fa2e77f977096251899d1410986adf6 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-89701 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-89701 cve-icon
History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms store a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this check but the TIME_DELEG paths do not. A malformed timespec can propagate through notify_change() to disk. Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path).
Title nfsd: validate nseconds in TIME_DELEG decode paths
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:46:18.807Z

Reserved: 2026-09-11T19:38:34.750Z

Link: CVE-2026-89701

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:57.303

Modified: 2026-09-11T20:19:57.303

Link: CVE-2026-89701

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:18Z

Links: CVE-2026-89701 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T04:30:07Z

Weaknesses