CVE-2026-89671

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs3 setacl by argp->mask

nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both

ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and

argp->acl_default verbatim. The NFSv3 ACL decoder only populates

those pointers when the corresponding mask bit is set:

nfs3svc_decode_setaclargs()

if (args->mask & NFS_ACL) decode into acl_access

if (args->mask & NFS_DFACL) decode into acl_default

/* otherwise the pointer stays NULL (pc_argzero) */

nfsd3_proc_setacl()

set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)

set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)

set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this

ACL type" operation. A NULL pointer that means "the client did not

send this arm" is therefore indistinguishable from "the client

asked to remove this ACL". A SETACL with mask=NFS_ACL silently

drops the directory's defa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References