GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89695 (GCVE-0-2026-89695)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: cap decoded POSIX ACL count to bound sort cost
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixacl() xdr_stream_decode_u32(&count) /* uncapped u32 */ posix_acl_alloc(count, GFP_KERNEL) sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */ The encoder side in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check. Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval, before any allocation, so the sort is bounded by NFS_ACL_MAX_ENTRIES^2 comparisons. While we're in here, also fix the nfserr_resource return if posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change it to return nfserr_jukebox as that's more appropriate for memory allocation failures.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 , < ea14d71d6ecb925673761bcf79f781f7dc9042cc (git)
Affected: 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 , < 4bc1108e876153a2dd6d874052b99182c3603135 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea14d71d6ecb925673761bcf79f781f7dc9042cc",
              "status": "affected",
              "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
              "versionType": "git"
            },
            {
              "lessThan": "4bc1108e876153a2dd6d874052b99182c3603135",
              "status": "affected",
              "version": "5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: cap decoded POSIX ACL count to bound sort cost\n\nnfsd4_decode_posixacl() reads a u32 entry count off the wire and passes\nit straight to posix_acl_alloc() and sort_pacl_range(). The latter is\nan O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in\nthe server\u0027s compound processing path.\n\n    nfsd4_decode_posixacl()\n      xdr_stream_decode_u32(\u0026count)       /* uncapped u32 */\n      posix_acl_alloc(count, GFP_KERNEL)\n      sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */\n\nThe encoder side in the same file already rejects ACLs whose a_count\nexceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit\n5fc51dfc2eb1 (\"NFSD: Add support for XDR decoding POSIX draft ACLs\")\nomitted the symmetric check.\n\nFix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with\nnfserr_inval, before any allocation, so the sort is bounded by\nNFS_ACL_MAX_ENTRIES^2 comparisons.\n\nWhile we\u0027re in here, also fix the nfserr_resource return if\nposix_acl_alloc() fails. That\u0027s not a legal error code for v4.1+. Change\nit to return nfserr_jukebox as that\u0027s more appropriate for memory\nallocation failures."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd\u0027s NFSv4 XDR decoder (nfsd4_decode_posixacl in fs/nfsd/nfs4xdr.c), reached when a remote client sends COMPOUND SETATTR, CREATE, or OPEN with POSIX draft ACL fattrs over TCP/2049.\nAC:L - The attacker supplies the u32 ACL count and reverse-sorted ACE payload on the wire; decode then runs sort_pacl_range() deterministically with no race, victim state, or memory-layout dependency.\nPR:N - nfsd4_decode_posixacl() runs during COMPOUND XDR decode before SEQUENCE, filehandle, export, or setattr checks; under AUTH_SYS, the common NFS flavor, RPC credentials are attacker-asserted and no secret is verified.\nUI:N - nfsd worker threads decode and sort the attacker\u0027s COMPOUND automatically; no local user or administrator action is required.\nS:U - Impact stays inside the host kernel\u0027s nfsd thread pool; this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:N - The bug only burns CPU while sorting a temporary decoded POSIX ACL; it does not read kernel or file contents, and a failed posix_acl_alloc() returns an NFS error without leaking memory.\nI:N - sort_pacl_range() only reorders the attacker\u0027s own temporary ACL buffer, which is discarded on error; no kernel memory is corrupted and no on-disk ACL is applied without later authorization.\nA:H - A client-chosen ACE count, practically hundreds of thousands within the 4MiB RPC payload, drives an un-preempted O(n^2) bubble sort in an nfsd thread, stalling the finite nfsd pool so repeated requests fully deny NFS service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:18.615Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea14d71d6ecb925673761bcf79f781f7dc9042cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc1108e876153a2dd6d874052b99182c3603135"
        }
      ],
      "title": "nfsd: cap decoded POSIX ACL count to bound sort cost",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89695",
    "datePublished": "2026-09-11T19:46:14.258Z",
    "dateReserved": "2026-09-11T19:38:34.750Z",
    "dateUpdated": "2026-09-13T06:33:18.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89695",
      "date": "2026-09-16",
      "epss": "0.00488",
      "percentile": "0.40814"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89695\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:56.610\",\"lastModified\":\"2026-09-13T07:17:35.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: cap decoded POSIX ACL count to bound sort cost\\n\\nnfsd4_decode_posixacl() reads a u32 entry count off the wire and passes\\nit straight to posix_acl_alloc() and sort_pacl_range(). The latter is\\nan O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in\\nthe server\u0027s compound processing path.\\n\\n    nfsd4_decode_posixacl()\\n      xdr_stream_decode_u32(\u0026count)       /* uncapped u32 */\\n      posix_acl_alloc(count, GFP_KERNEL)\\n      sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */\\n\\nThe encoder side in the same file already rejects ACLs whose a_count\\nexceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit\\n5fc51dfc2eb1 (\\\"NFSD: Add support for XDR decoding POSIX draft ACLs\\\")\\nomitted the symmetric check.\\n\\nFix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with\\nnfserr_inval, before any allocation, so the sort is bounded by\\nNFS_ACL_MAX_ENTRIES^2 comparisons.\\n\\nWhile we\u0027re in here, also fix the nfserr_resource return if\\nposix_acl_alloc() fails. That\u0027s not a legal error code for v4.1+. Change\\nit to return nfserr_jukebox as that\u0027s more appropriate for memory\\nallocation failures.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05\",\"lessThan\":\"ea14d71d6ecb925673761bcf79f781f7dc9042cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05\",\"lessThan\":\"4bc1108e876153a2dd6d874052b99182c3603135\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4bc1108e876153a2dd6d874052b99182c3603135\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea14d71d6ecb925673761bcf79f781f7dc9042cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T12:25:18+00:00",
      "cve": "CVE-2026-89695",
      "id": "CVE-2026-89695",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: cap decoded POSIX ACL count to bound sort cost",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89695.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:02Z",
      "cve": "CVE-2026-89695",
      "id": "CVE-2026-89695",
      "initial_release_date": "2026-09-12T16:23:35Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89695",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89695.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.