CVE-2026-89672
largeSilent POSIX ACL stripping in Linux kernel nfsd via NFSACL v2 SETACL requests
The Linux kernel's NFS server (nfsd) mishandles NFSACL v2 SETACL requests: when the request mask omits the NFS_ACL or NFS_DFACL bit, the decoder leaves the corresponding access- or default-ACL pointer NULL, but nfsacld_proc_setacl() passes both pointers to set_posix_acl() unconditionally — and a NULL argument is the VFS operation to delete that ACL. An attacker who can send NFSACL RPC calls to an nfsd export (NFS relies on weak source-IP/AUTH_SYS checks, matching the PR:N/AV:N scoring) can send a SETACL with only NFS_ACL set to silently delete a directory's default ACL, or a mask of zero to delete both ACLs. Because POSIX ACLs are often the only thing gating access to exported files, stripping them can expose sensitive data to unauthorized users and allow modification, which is why the flaw is rated critical (CVSS 9.1, confidentiality and integrity high, availability unaffected). Any Linux system running the kernel nfsd with the NFSACL v2 path is affected; the fix gates each set_posix_acl() call on its mask bit so omitted arms are ignored. No public proof of concept or in-the-wild exploitation is known, and the CVE is not on the CISA KEV list.
What to do: Apply a kernel update containing the fix (the commit gating the two set_posix_acl() calls in nfsacld_proc_setacl() on argp->mask) as soon as your distribution ships it. Until patched, firewall TCP/UDP 2049 and the rpcbind/mountd services from untrusted networks, restrict exports to explicitly trusted client IPs, and disable NFSv2/NFSACL support if no legacy clients require it. Audit exported trees for unexpectedly missing POSIX access and default ACLs, since successful exploitation leaves no error in the server logs.
| Linux (kernel.org) Linux kernel, nfsd NFSACL v2 (nfsacld_proc_setacl) | All kernel versions containing the vulnerable code prior to the upstream fix commit; the advisory data does not state specific version numbers, so check your ve |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
In the news0 stories
No ingested article mentions this CVE yet.