GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89672 (GCVE-0-2026-89672)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
nfsd: gate nfs2 setacl by argp->mask
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 8e4422b05f410f95c51b68a0db4bf1d87f6d22f5 (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < e41d173d9dc735cecb15ab7aa63ecab09338f81b (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < f951b22dbeec46f2e0fba81cb80d1b0c686b61eb (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 37eea38e7898538f0ec5f1eb8b18d8646e4be41c (git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < a3a7e20ed66d3f04d37883c398da8a113b430769 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.13
Unaffected: 0 , < 2.6.13 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e4422b05f410f95c51b68a0db4bf1d87f6d22f5",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp-\u003emask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp-\u003eacl_access\nonly when NFS_ACL is set in the request mask and argp-\u003eacl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory\u0027s default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.\nAC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.\nPR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.\nUI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.\nS:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.\nI:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.\nA:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:57.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"
        }
      ],
      "title": "nfsd: gate nfs2 setacl by argp-\u003emask",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89672",
    "datePublished": "2026-09-11T19:45:57.414Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-09-14T12:01:57.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89672",
      "date": "2026-09-15",
      "epss": "0.00522",
      "percentile": "0.42858"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:48:38.000Z",
      "cve": "CVE-2026-89672",
      "id": "msrc_CVE-2026-89672",
      "initial_release_date": "2026-09-13T01:01:33.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfsd: gate nfs2 setacl by argp-\u003emask",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89672.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89672\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:53.770\",\"lastModified\":\"2026-09-14T13:19:19.193\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: gate nfs2 setacl by argp-\u003emask\\n\\nThe NFSACL v2 SETACL path shares the decoder convention used by its\\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp-\u003eacl_access\\nonly when NFS_ACL is set in the request mask and argp-\u003eacl_default\\nonly when NFS_DFACL is set, leaving the other pointer NULL because\\nthe argument buffer is zeroed up to pc_argzero before decode.\\n\\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\\n\\\"remove this ACL type\\\" operation, so an omitted arm is\\nindistinguishable from an explicit request to delete that ACL. A\\nSETACL carrying only NFS_ACL silently strips the directory\u0027s default\\nACL; mask=0 strips both.\\n\\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\\nsame remedy. Gate each set_posix_acl() call on its mask bit and\\ninitialize error to 0 so that a request with neither bit set leaves\\nthe on-disk ACLs untouched and returns success. The out_drop_lock\\npath and the unconditional posix_acl_release() in\\nnfsaclsvc_release_setacl() already tolerate the skipped arms.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs2acl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a257cdd0e2179630d3201c32ba14d7fcb3c3a055\",\"lessThan\":\"8e4422b05f410f95c51b68a0db4bf1d87f6d22f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a257cdd0e2179630d3201c32ba14d7fcb3c3a055\",\"lessThan\":\"e41d173d9dc735cecb15ab7aa63ecab09338f81b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a257cdd0e2179630d3201c32ba14d7fcb3c3a055\",\"lessThan\":\"f951b22dbeec46f2e0fba81cb80d1b0c686b61eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a257cdd0e2179630d3201c32ba14d7fcb3c3a055\",\"lessThan\":\"37eea38e7898538f0ec5f1eb8b18d8646e4be41c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a257cdd0e2179630d3201c32ba14d7fcb3c3a055\",\"lessThan\":\"a3a7e20ed66d3f04d37883c398da8a113b430769\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs2acl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T15:02:24+00:00",
      "cve": "CVE-2026-89672",
      "id": "CVE-2026-89672",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: gate nfs2 setacl by argp-\u003emask",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89672.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:36Z",
      "cve": "CVE-2026-89672",
      "id": "CVE-2026-89672",
      "initial_release_date": "2026-09-15T00:57:32Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89672",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89672.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.