GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89671 (GCVE-0-2026-89671)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
nfsd: gate nfs3 setacl by argp->mask
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and argp->acl_default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set: nfs3svc_decode_setaclargs() if (args->mask & NFS_ACL) decode into acl_access if (args->mask & NFS_DFACL) decode into acl_default /* otherwise the pointer stays NULL (pc_argzero) */ nfsd3_proc_setacl() set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access) set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default) set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFS_ACL silently drops the directory's default ACL; mask=0 drops both. The sibling nfsd3_proc_getacl() already consults argp->mask before touching each arm; mirror that in setacl. Fix by wrapping each set_posix_acl() call in the matching mask bit check and initializing error to 0 before inode_lock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfs_ok. The out_drop_lock path and the unconditional posix_acl_release() at out: are preserved; both NULL-tolerate the skipped arms.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 3be1d8611dae4829e4608007db29f4a8748c37b2 (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 68a80b26efdff1d09f8ae1773c6a915abb9e191d (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b3bff820d068ea59767d4e91a3258231a879da5f (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < ff99ed007f065198fd723152405c22aa558f700b (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 453d7198a0ab07a12d46e0575861ac7b932da17e (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.13
Unaffected: 0 , < 2.6.13 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n    nfs3svc_decode_setaclargs()\n      if (args-\u003emask \u0026 NFS_ACL)    decode into acl_access\n      if (args-\u003emask \u0026 NFS_DFACL)  decode into acl_default\n      /* otherwise the pointer stays NULL (pc_argzero) */\n\n    nfsd3_proc_setacl()\n      set_posix_acl(.., ACL_TYPE_ACCESS,  argp-\u003eacl_access)\n      set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.\nAC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.\nPR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.\nUI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.\nS:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.\nI:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.\nA:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:56.734Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
        },
        {
          "url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
        }
      ],
      "title": "nfsd: gate nfs3 setacl by argp-\u003emask",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89671",
    "datePublished": "2026-09-11T19:45:56.604Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-09-14T12:01:56.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89671",
      "date": "2026-09-17",
      "epss": "0.00487",
      "percentile": "0.40826"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:55:18.000Z",
      "cve": "CVE-2026-89671",
      "id": "msrc_CVE-2026-89671",
      "initial_release_date": "2026-09-13T01:08:37.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfsd: gate nfs3 setacl by argp-\u003emask",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89671.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs3acl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
                    "status": "affected",
                    "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
                    "status": "affected",
                    "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
                    "status": "affected",
                    "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
                    "status": "affected",
                    "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
                    "status": "affected",
                    "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs3acl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.13"
                  },
                  {
                    "lessThan": "2.6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n    nfs3svc_decode_setaclargs()\n      if (args-\u003emask \u0026 NFS_ACL)    decode into acl_access\n      if (args-\u003emask \u0026 NFS_DFACL)  decode into acl_default\n      /* otherwise the pointer stays NULL (pc_argzero) */\n\n    nfsd3_proc_setacl()\n      set_posix_acl(.., ACL_TYPE_ACCESS,  argp-\u003eacl_access)\n      set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
          }
        ],
        "id": "CVE-2026-89671",
        "lastModified": "2026-09-14T13:19:19.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:53.647",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T07:00:24+00:00",
      "cve": "CVE-2026-89671",
      "id": "CVE-2026-89671",
      "initial_release_date": "2026-09-11T19:45:56.604000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: NFSv3 `nfsd` allows unauthorized ACL removal via crafted SETACL requests.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89671.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:00:38Z",
      "cve": "CVE-2026-89671",
      "id": "CVE-2026-89671",
      "initial_release_date": "2026-09-12T16:23:56Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89671",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89671.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.