CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to the client via CB OFFLOAD after the worker kthread completes. When the post-copy vfs fsync range() or filemap check wb err() in nfsd copy file range() reports an error, the worker correctly leaves NFSD4 COPY F COMMITTED clear so that CB OFFLOAD encodes wr stable how as NFS UNSTABLE, but the server's write verifier is not rotated.

A client that receives NFS UNSTABLE in CB OFFLOAD follows up with COMMIT to make the copied data durable. With the verifier unchanged, COMMIT returns the same value the client just received via CB OFFLOAD, and the client concludes the copy is durable -- silently dropping the data whose writeback in fact failed. This violates the UNSTABLE+COMMIT durability contract (RFC 7862 section 15.1, RFC 8881 section 18.32) and matches the bug just fixed in nfsd vfs write() and nfsd commit().

Rotate nn->writeverf at the writeback-failure site. The async COPY worker has no svc rqst, so commit reset write verifier() is not available here; calling nfsd reset write verifier() directly mirrors the trace-less reset already used by nfsd file check write error() for the same purpose. Filter out -EAGAIN and -ESTALE, matching commit reset write verifier(), since neither indicates a durable-storage failure.