{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-89713",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89713",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-11T19:46:27.752Z",
    "updatedAt": "2026-10-21T12:48:27.026Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "NFSD: check truncate permission under inode lock",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode->i_size load.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "52d0c5bdfe232c9974d4b11f97078b9c7814f05d"
            },
            {
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24"
            },
            {
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d"
            },
            {
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "44086254479035de42ca3d286ecf25521d4e6325"
            },
            {
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f"
            },
            {
              "version": "604a3c407026d6162d15300478e63f901e435efc",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "3ee4f442e5b37a537297b812557b1163f96b5399",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "982898d7f97a35447403c3fcecc0d96c646ce101",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "3.2.89",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "3.3"
            },
            {
              "version": "3.16.44",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "3.17"
            },
            {
              "version": "4.4.53",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.5"
            },
            {
              "version": "4.9.14",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.10"
            },
            {
              "version": "4.10.2",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.11"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.11",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.11"
            },
            {
              "version": "6.6.160",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.109",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.50",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}