CVE-2026-89695
largeUnauthenticated CPU Denial of Service in Linux Kernel nfsd via POSIX ACL Decoding
The Linux kernel's NFS server (nfsd) fails to validate the POSIX ACL entry count in nfsd4_decode_posixacl(), which reads an attacker-supplied 32-bit count off the wire and passes it directly to posix_acl_alloc() and sort_pacl_range(), an O(n^2) bubble sort. A remote, unauthenticated actor who can reach an NFSv4 service can send a crafted compound request with a huge ACL count, driving unbounded CPU consumption and exhausting the server — a pure availability attack with no confidentiality or integrity impact. The encoder side already rejected counts above NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 (XDR decoding of POSIX draft ACLs) omitted the symmetric check. Any host running a kernel containing that commit and lacking the fix is affected when nfsd is exposed to network clients. No public proof of concept or known exploitation has been reported.
What to do: Update to a kernel release containing the fix, which rejects wire ACL counts greater than NFS_ACL_MAX_ENTRIES with nfserr_inval before any allocation, bounding the sort cost. Until patched, restrict access to TCP 2049 via firewalling so only trusted NFS clients can reach the server, and monitor for sustained CPU spikes in nfsd compound processing as an indicator of attempted exploitation.
| Linux kernel (nfsd, NFSv4 POSIX draft ACL decoding) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixacl() xdr_stream_decode_u32(&count) /* uncapped u32 */ posix_acl_alloc(count, GFP_KERNEL) sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */ The encoder side in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check. Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval, before any allocation, so the sort is bounded by NFS_ACL_MAX_ENTRIES^2 comparisons. While we're in here, also fix the nfserr_resource return if posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change it to return nfserr_jukebox as that's more appropriate for memory allocation failures.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.