CVE-2026-89672

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its

v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access

only when NFS_ACL is set in the request mask and argp->acl_default

only when NFS_DFACL is set, leaving the other pointer NULL because

the argument buffer is zeroed up to pc_argzero before decode.

nfsacld_proc_setacl() then hands both pointers to set_posix_acl()

unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS

"remove this ACL type" operation, so an omitted arm is

indistinguishable from an explicit request to delete that ACL. A

SETACL carrying only NFS_ACL silently strips the directory's default

ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3_proc_setacl(); apply the

same remedy. Gate each set_posix_acl() call on its mask bit and

initialize error to 0 so that a request with neither bit set leaves

the on-di

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References