{"id":"CVE-2026-89672","title":"nfsd: gate nfs2 setacl by argp->mask","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_a…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-266"],"vendor":"Linux","product":"Linux","affected":["Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 8e4422b05f410f95c51b68a0db4bf1d87f6d22f5","Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < e41d173d9dc735cecb15ab7aa63ecab09338f81b","Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < f951b22dbeec46f2e0fba81cb80d1b0c686b61eb","Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 37eea38e7898538f0ec5f1eb8b18d8646e4be41c","Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < a3a7e20ed66d3f04d37883c398da8a113b430769","Linux 2.6.13"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:25:46.874632Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:50:45.617Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89672","references":[{"url":"https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"},{"url":"https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"},{"url":"https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"},{"url":"https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"},{"url":"https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89672.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89672"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532465"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89672"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89672"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89672.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00523,"epssPercentile":0.44173,"scores":{"cna":9.1,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89672","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms.\n\n## Affected\n\n- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 8e4422b05f410f95c51b68a0db4bf1d87f6d22f5`\n- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < e41d173d9dc735cecb15ab7aa63ecab09338f81b`\n- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < f951b22dbeec46f2e0fba81cb80d1b0c686b61eb`\n- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 37eea38e7898538f0ec5f1eb8b18d8646e4be41c`\n- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < a3a7e20ed66d3f04d37883c398da8a113b430769`\n- `Linux 2.6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89672.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223246,"id":"CVE-2026-89672","ts":1792180029976,"field":"cvss","old":"7","new":"9.1"},{"seq":223245,"id":"CVE-2026-89672","ts":1792180029976,"field":"severity","old":"high","new":"critical"},{"seq":205456,"id":"CVE-2026-89672","ts":1789576719236,"field":"cvss","old":"9.1","new":"7"},{"seq":205455,"id":"CVE-2026-89672","ts":1789576719236,"field":"severity","old":"critical","new":"high"},{"seq":197762,"id":"CVE-2026-89672","ts":1789384318742,"field":"cvss","old":"6.8","new":"9.1"},{"seq":197761,"id":"CVE-2026-89672","ts":1789384318742,"field":"severity","old":"medium","new":"critical"},{"seq":183371,"id":"CVE-2026-89672","ts":1789356675085,"field":"cvss","old":"9.1","new":"6.8"},{"seq":183370,"id":"CVE-2026-89672","ts":1789356675085,"field":"severity","old":"critical","new":"medium"},{"seq":153538,"id":"CVE-2026-89672","ts":1789285351198,"field":"cvss","old":null,"new":"9.1"},{"seq":153537,"id":"CVE-2026-89672","ts":1789285351198,"field":"severity","old":"none","new":"critical"},{"seq":147157,"id":"CVE-2026-89672","ts":1789270197625,"field":"cvss","old":null,"new":"6.8"},{"seq":147156,"id":"CVE-2026-89672","ts":1789270197625,"field":"severity","old":"none","new":"medium"},{"seq":108916,"id":"CVE-2026-89672","ts":1789183729527,"field":"cvss","old":null,"new":"6.8"},{"seq":108915,"id":"CVE-2026-89672","ts":1789183729527,"field":"severity","old":"none","new":"medium"}]}