A critical race condition in the Linux kernel Network File System (NFSD) could allow an unauthenticated remote attacker to bypass append-only restrictions and truncate files.

This is a Time of Check to Time of Use (TOCTOU) race condition within the nfsd_setattr function. An unauthenticated attacker can exploit the window between the initial size check and the inode lock to perform unauthorized file truncation, bypassing append-only file protections.

Successful exploitation of this vulnerability permits an attacker to corrupt or delete data within append-only files, potentially leading to a loss of system integrity or service availability. Given the CVSS score of 9.1, this represents a critical risk that could be leveraged to disrupt logging mechanisms or modify critical configuration files, leading to unauthorized system states.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary locking logic changes.

Proactive Monitoring: Monitor system logs for unusual NFS activity or unexpected file modification events, particularly those involving sensitive append-only files.

Compensating Controls: Restrict access to the NFS service to trusted network segments to reduce the attack surface until kernel patches can be applied.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity of files managed via NFS. Because the Linux kernel is foundational to enterprise infrastructure, administrators should prioritize testing and deploying the provided kernel patches across all affected environments as soon as possible to prevent potential data corruption.