CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved:

NFSD: check truncate permission under inode lock

nfsd setattr() checks whether a size update needs NFSD MAY TRUNC before it takes inode lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE update is applied later under inode lock() by notify change().

This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd setattr() takes inode lock(). notify change() then applies a real truncation without the NFSD MAY TRUNC check that rejects IS APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify change(), so NFSD must make this decision against the locked size it is about to change.

Split the write-count acquisition from the truncation permission check. Keep get write access() before the locked setattr work, then recheck whether the requested size is below i size read(inode) after inode lock() has been acquired and before notify change(ATTR SIZE). This also avoids the plain unlocked inode->i size load.