CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

nfsd copy file range() samples dst->f wb err into "since" after the copy loop, then uses it to detect writeback errors via filemap check wb err() once vfs fsync range() returns. Because the nfsd file cache reuses a single struct file across requests targeting the same inode, a concurrent COMMIT or stable WRITE on dst advances dst->f wb err to the current mapping->wb err via file check and advance wb err() during its own vfs fsync range(). If that advancement lands between the writeback error appearing in mapping->wb err and the COPY worker sampling "since", the worker captures the already-advanced cursor, errseq check() sees cur == since and returns zero, and NFSD4 COPY F COMMITTED is set even though writeback failed. CB OFFLOAD then encodes wr stable how = FILE SYNC4, the client treats the copied data as durable, and the failure becomes silent data loss.

Sample since once at the start of the function. The cursor then reflects state in effect before this COPY issues any writes, and filemap check wb err() detects any error that occurs during the copy regardless of which thread first observes it. This matches the pattern used by nfsd vfs write() and nfsd4 clone file range().