CVE-2026-89695

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes

it straight to posix_acl_alloc() and sort_pacl_range(). The latter is

an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in

the server's compound processing path.

nfsd4_decode_posixacl()

xdr_stream_decode_u32(&count) /* uncapped u32 */

posix_acl_alloc(count, GFP_KERNEL)

sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */

The encoder side in the same file already rejects ACLs whose a_count

exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit

5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")

omitted the symmetric check.

Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with

nfserr_inval, before any allocation, so the sort is bounded by

NFS_ACL_MAX_ENTRIES^2 comparisons.

While we're in here, als

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References