CVE-2026-89672

Status: UPDATED  |  Advisory ID: CVE-2026-89672

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its

v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access

only when NFS_ACL is set in the request mask and argp->acl_default

only when NFS_DFACL is set, leaving the other pointer NULL because

the argument buffer is zeroed up to pc_argzero before decode.

nfsacld_proc_setacl() then hands both pointers to set_posix_acl()

unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS

"remove this ACL type" operation, so an omitted arm is

indistinguishable from an explicit request to delete that ACL. A

SETACL carrying only NFS_ACL silently strips the directory's default

ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3_proc_setacl(); apply the

same remedy. Gate each set_posix_acl() call on its mask bit and

initialize error to 0 so that a request with neither bit set leaves

the on-disk ACLs untouched and returns success. The out_drop_lock

path and the unconditional posix_acl_release() in

nfsaclsvc_release_setacl() already tolerate the skipped arms. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References