CVE-2026-89671 (GCVE-0-2026-89671)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-10-30 12:32
VLAI
EPSS
VEX
Title
nfsd: gate nfs3 setacl by argp->mask
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: gate nfs3 setacl by argp->mask
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and
argp->acl_default verbatim. The NFSv3 ACL decoder only populates
those pointers when the corresponding mask bit is set:
nfs3svc_decode_setaclargs()
if (args->mask & NFS_ACL) decode into acl_access
if (args->mask & NFS_DFACL) decode into acl_default
/* otherwise the pointer stays NULL (pc_argzero) */
nfsd3_proc_setacl()
set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)
set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)
set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this
ACL type" operation. A NULL pointer that means "the client did not
send this arm" is therefore indistinguishable from "the client
asked to remove this ACL". A SETACL with mask=NFS_ACL silently
drops the directory's default ACL; mask=0 drops both.
The sibling nfsd3_proc_getacl() already consults argp->mask before
touching each arm; mirror that in setacl.
Fix by wrapping each set_posix_acl() call in the matching mask bit
check and initializing error to 0 before inode_lock so that a
request with neither bit set leaves the on-disk ACLs untouched and
returns nfs_ok. The out_drop_lock path and the unconditional
posix_acl_release() at out: are preserved; both NULL-tolerate the
skipped arms.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:25 UTC
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < beeb33152873ad40692bd255b562966f8ba43dbd
(git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 3be1d8611dae4829e4608007db29f4a8748c37b2 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 68a80b26efdff1d09f8ae1773c6a915abb9e191d (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b3bff820d068ea59767d4e91a3258231a879da5f (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < ff99ed007f065198fd723152405c22aa558f700b (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 453d7198a0ab07a12d46e0575861ac7b932da17e (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.13
Unaffected: 0 , < 2.6.13 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:43.543380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:48.048Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "beeb33152873ad40692bd255b562966f8ba43dbd",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n nfs3svc_decode_setaclargs()\n if (args-\u003emask \u0026 NFS_ACL) decode into acl_access\n if (args-\u003emask \u0026 NFS_DFACL) decode into acl_default\n /* otherwise the pointer stays NULL (pc_argzero) */\n\n nfsd3_proc_setacl()\n set_posix_acl(.., ACL_TYPE_ACCESS, argp-\u003eacl_access)\n set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.\nAC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.\nPR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.\nUI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.\nS:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.\nI:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.\nA:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:36.627Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/beeb33152873ad40692bd255b562966f8ba43dbd"
},
{
"url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
},
{
"url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
},
{
"url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
},
{
"url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
},
{
"url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
}
],
"title": "nfsd: gate nfs3 setacl by argp-\u003emask",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89671",
"datePublished": "2026-09-11T19:45:56.604Z",
"dateReserved": "2026-09-11T19:38:34.746Z",
"dateUpdated": "2026-10-30T12:32:36.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89671",
"date": "2026-11-01",
"epss": "0.00545",
"percentile": "0.45738"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:07:53.000Z",
"cve": "CVE-2026-89671",
"id": "msrc_CVE-2026-89671",
"initial_release_date": "2026-09-13T01:08:37.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "nfsd: gate nfs3 setacl by argp-\u003emask",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89671.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "beeb33152873ad40692bd255b562966f8ba43dbd",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n nfs3svc_decode_setaclargs()\n if (args-\u003emask \u0026 NFS_ACL) decode into acl_access\n if (args-\u003emask \u0026 NFS_DFACL) decode into acl_default\n /* otherwise the pointer stays NULL (pc_argzero) */\n\n nfsd3_proc_setacl()\n set_posix_acl(.., ACL_TYPE_ACCESS, argp-\u003eacl_access)\n set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
}
],
"id": "CVE-2026-89671",
"lastModified": "2026-10-30T13:20:25.420",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-89671",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:43.543380Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-11T20:19:53.647",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/beeb33152873ad40692bd255b562966f8ba43dbd"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-30T15:11:02+00:00",
"cve": "CVE-2026-89671",
"id": "CVE-2026-89671",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "279",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nfsd: gate nfs3 setacl by argp-\u003emask",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89671.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:43.543380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:25:44.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n nfs3svc_decode_setaclargs()\n if (args-\u003emask \u0026 NFS_ACL) decode into acl_access\n if (args-\u003emask \u0026 NFS_DFACL) decode into acl_default\n /* otherwise the pointer stays NULL (pc_argzero) */\n\n nfsd3_proc_setacl()\n set_posix_acl(.., ACL_TYPE_ACCESS, argp-\u003eacl_access)\n set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.\nAC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.\nPR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.\nUI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.\nS:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.\nI:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.\nA:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:50:44.635Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
},
{
"url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
},
{
"url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
},
{
"url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
},
{
"url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
}
],
"title": "nfsd: gate nfs3 setacl by argp-\u003emask",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89671",
"datePublished": "2026-09-11T19:45:56.604Z",
"dateReserved": "2026-09-11T19:38:34.746Z",
"dateUpdated": "2026-10-19T08:50:44.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.