CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix partial-write detection in nfsd direct write

nfsd direct write() walks a list of write segments and, after each vfs iocb iter write(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset:

host err = vfs iocb iter write(file, kiocb, &segments[i].iter); if (host err < 0) return host err; cnt += host err; if (host err < segments[i].iter.count) break; / partial write */

vfs iocb iter write() runs the iter through ->write iter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length:

before write iter: iter.count == original len after write iter: iter.count == original len - host err

The condition then reduces to host err < original len - host err, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->ki pos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting *cnt to the NFS client.

Snapshot the segment's byte count before the write and compare host err against that snapshot so any short write breaks the loop.