CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix partial-write detection in nfsd_direct_write

nfsd_direct_write() walks a list of write segments and, after each

vfs_iocb_iter_write(), tries to detect a short write so the loop can

stop before placing the next segment at a wrong file offset:

host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);

if (host_err < 0)

return host_err;

*cnt += host_err;

if (host_err < segments[i].iter.count)

break; /* partial write */

vfs_iocb_iter_write() runs the iter through ->write_iter(), which

advances the iter by the number of bytes written. By the time the

check runs, segments[i].iter.count is the residual, not the original

request length:

before write_iter: iter.count == original_len

after write_iter: iter.count == original_len - host_err

The condition then reduces to host_err < original_len - host_err, so

the break fires only when less than half of the segment was written.

Any short write completing between 50% and 99% of the segment slips

through; the loop advances to the next segment with kiocb->ki_pos

only bumped by the short amount, writing the next segment's payload

at the wrong offset and over-reporting *cnt to the NFS client.

Snapshot the segment's byte count before the write and compare

host_err against that snapshot so any short write breaks the loop.