EUVD-2026-76609
GHSA-36mf-r537-f6c6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Authenticated NFSv2 client (PR:L) hitting a narrow both-times-set path plus a remount race (AC:H); no disclosure (C:N) and only a transient integrity/availability window (I:L/A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference.
Add the missing fh_want_write() call after the early fh_verify().
AnalysisAI
Missing mount write-reference in the Linux kernel NFS server (nfsd) lets an authenticated NFSv2 client's SETATTR request run notify_change() without acquiring a mount write reference, bypassing the read-only-remount protection that fh_want_write() normally provides. The flaw affects the BOTH_TIME_SET branch of nfsd_proc_setattr(), which calls fh_verify() early so setattr_prepare() can inspect the dentry, causing nfsd_setattr() to skip the fh_want_write() call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an NFS server (nfsd) exporting a filesystem over NFSv2 and an authenticated client authorized to perform SETATTR operations on it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply with the assigned severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later on your maintained series); the fix simply re-adds the fh_want_write() call after the early fh_verify() in nfsd_proc_setattr(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Linux systems running NFSv2 server and identify kernel versions, prioritizing systems on kernel 6.12.x (prior to .109), 6.18.x (prior to .50), 7.2.x (prior to .4), or 7.3-rc1 and earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today