The Linux kernel's nfsd component had a vulnerability where the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds value directly into the tv_nsec field without enforcing that nseconds is less than NSEC_PER_SEC. While the legacy nfsd4_decode_nfstime4 function performed this check, the TIME_DELEG paths did not, allowing malformed timespec values to propagate through notify_change() to disk. The fix involved adding range checks in nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path) to validate nseconds properly.

Malformed timespec values could propagate through the NFS server's notify_change() function to disk operations. This could potentially lead to incorrect time values being written to disk metadata, which might affect file timestamps or related filesystem behaviors. No specific exploitation details or active exploits are reported.

A fix has been implemented in the Linux kernel source code by adding range checks for the nseconds field in the TIME_DELEG decode paths. Users should update their Linux kernel to a version that includes this patch to remediate the vulnerability.