{"id":"CVE-2026-89672","state":"PUBLISHED","title":"nfsd: gate nfs2 setacl by argp->mask","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms.","publishedAt":"2026-09-11T19:45:57.414Z","updatedAt":"2026-10-30T12:32:37.687Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"d00a2f81ba7c57045bd644971ddb6961c5efe3e0","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"760e7a4f92f597c61ab6b089f934a7e3acf238b7","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"54ff9c81d6b77de4540ba33a3b4d613ce3194863","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"8e4422b05f410f95c51b68a0db4bf1d87f6d22f5","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"e41d173d9dc735cecb15ab7aa63ecab09338f81b","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"f951b22dbeec46f2e0fba81cb80d1b0c686b61eb","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"37eea38e7898538f0ec5f1eb8b18d8646e4be41c","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"a3a7e20ed66d3f04d37883c398da8a113b430769","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs2acl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.13","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs2acl.c"]}],"references":["https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0","https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7","https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863","https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5","https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b","https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb","https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c","https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"],"weaknesses":[],"ingestedAt":"2026-10-30T12:52:04.348Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89672.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89672","state":"PUBLISHED","datePublished":"2026-09-11T19:45:57.414Z","dateUpdated":"2026-10-30T12:32:37.687Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.746Z"},"containers":{"cna":{"title":"nfsd: gate nfs2 setacl by argp->mask","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"d00a2f81ba7c57045bd644971ddb6961c5efe3e0","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"760e7a4f92f597c61ab6b089f934a7e3acf238b7","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"54ff9c81d6b77de4540ba33a3b4d613ce3194863","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"8e4422b05f410f95c51b68a0db4bf1d87f6d22f5","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"e41d173d9dc735cecb15ab7aa63ecab09338f81b","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"f951b22dbeec46f2e0fba81cb80d1b0c686b61eb","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"37eea38e7898538f0ec5f1eb8b18d8646e4be41c","versionType":"git"},{"version":"a257cdd0e2179630d3201c32ba14d7fcb3c3a055","status":"affected","lessThan":"a3a7e20ed66d3f04d37883c398da8a113b430769","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs2acl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.13","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs2acl.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0"},{"url":"https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7"},{"url":"https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863"},{"url":"https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"},{"url":"https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"},{"url":"https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"},{"url":"https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"},{"url":"https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.\nAC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.\nPR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.\nUI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.\nS:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.\nI:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.\nA:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:37.687Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.13","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89672","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:25:46.874632Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:48.206Z"}}]}}}