CVE-2026-89697 (CVSS 9.1)

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify().

Is your site exposed to CVE-2026-89697?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS — Exploit Prediction

0.0069

Probability of exploitation

0.51%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500 https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08 https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9 https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175 https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4

Frequently Asked Questions

What is CVE-2026-89697? +

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the early fh_verify(). It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2026-89697? +

CVE-2026-89697 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0069, placing it in the 1th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-89697? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89697