The Linux kernel NFSD component had a TOCTOU vulnerability in nfsd_setattr() where the truncate permission check used an unlocked read of the file size before acquiring inode_lock(). This allowed a concurrent append operation to extend an append-only file between the permission check and the actual truncation, bypassing append-only restrictions. The patch splits the write-count acquisition from the truncation permission check and rechecks the file size under inode_lock() before applying the truncation, eliminating the race window.

This vulnerability could allow a client to bypass append-only file restrictions by exploiting a race condition in the truncate permission check, potentially leading to unauthorized file truncation or modification. However, the impact is limited to NFS server operations involving append-only files and concurrent SETATTR requests. There are no known exploits in the wild.

A fix has been applied in the Linux kernel to perform the truncate permission check under the inode lock, eliminating the TOCTOU race condition. Users should update to the patched kernel version once available. No additional mitigation is required beyond applying the official fix.