nfsd: fix partial-write detection in nfsd_direct_write

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list of write segments and, after each vfs_iocb_iter_write(), tries to detect a short write so the loop can stop before placing the next segment at a wrong file offset: host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter); if (host_err < 0) return host_err; *cnt += host_err; if (host_err < segments[i].iter.count) break; /* partial write */ vfs_iocb_iter_write() runs the iter through ->write_iter(), which advances the iter by the number of bytes written. By the time the check runs, segments[i].iter.count is the residual, not the original request length: before write_iter: iter.count == original_len after write_iter: iter.count == original_len - host_err The condition then reduces to host_err < original_len - host_err, so the break fires only when less than half of the segment was written. Any short write completing between 50% and 99% of the segment slips through; the loop advances to the next segment with kiocb->ki_pos only bumped by the short amount, writing the next segment's payload at the wrong offset and over-reporting *cnt to the NFS client. Snapshot the segment's byte count before the write and compare host_err against that snapshot so any short write breaks the loop.

Timeline

1. Sep 11, 2026, 7:46 PM UTCCVE published
2. Oct 19, 2026, 8:50 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 06c5c97293e3fca99ce15da157068edf45a7c6e4 · fixed in fa6590dfd16ab55f03b658b079072ace3504825e; From 06c5c97293e3fca99ce15da157068edf45a7c6e4 · fixed in 250ec14932d5cfe102f68a57892bb566eee7f83e

• Linux Linux

  6.19

• KernelLinux

  From 6.19.0 · fixed in 7.2.4

References 2