Bug 2502220 (CVE-2026-53393)

Summary:	CVE-2026-53393 kernel: nfsd: reset write verifier on deferred writeback errors
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Network File System (NFS) daemon. This vulnerability occurs when the NFS daemon fails to reset the write verifier during deferred writeback errors for UNSTABLE writes. A remote attacker, acting as an NFS client, could exploit this by performing operations that trigger these errors. This could lead to silent data loss, as clients might incorrectly assume their data has been durably written, violating the NFS durability contract.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 13:02:31 UTC

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reset write verifier on deferred writeback errors

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to
detect deferred writeback errors, but neither rotates the server's write
verifier (nn->writeverf) when this check fails. Every other
durable-storage-failure path in these functions calls
commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the
current verifier will COMMIT, receive the unchanged verifier back, and
conclude their data is durable — silently dropping data that failed
writeback. This violates the UNSTABLE+COMMIT durability contract
(RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err()
error sites, matching the pattern used by adjacent error paths in the
same functions. The helper already filters -EAGAIN and -ESTALE
internally, so the calls are unconditionally safe.

Comment 1 Keith Grant 2026-07-20 13:54:48 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-53393-37ff@gregkh/T