{"id":"CVE-2026-89695","title":"nfsd: cap decoded POSIX ACL count to bound sort cost","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: cap decoded POSIX ACL count to bound sort cost\n\nnfsd4_decode_posixacl() reads a u32 entry count off the wire and passes\nit straight to posix_acl_alloc() and sort_…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-606"],"vendor":"Linux","product":"Linux","affected":["Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < ea14d71d6ecb925673761bcf79f781f7dc9042cc","Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < 4bc1108e876153a2dd6d874052b99182c3603135","Linux 7.0"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:51:08.488Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89695","references":[{"url":"https://git.kernel.org/stable/c/ea14d71d6ecb925673761bcf79f781f7dc9042cc"},{"url":"https://git.kernel.org/stable/c/4bc1108e876153a2dd6d874052b99182c3603135"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89695.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89695"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532373"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89695"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89695"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89695.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00488,"epssPercentile":0.41785,"scores":{"cna":7.5,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.472Z","slug":"CVE-2026-89695","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: cap decoded POSIX ACL count to bound sort cost\n\nnfsd4_decode_posixacl() reads a u32 entry count off the wire and passes\nit straight to posix_acl_alloc() and sort_pacl_range(). The latter is\nan O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in\nthe server's compound processing path.\n\n    nfsd4_decode_posixacl()\n      xdr_stream_decode_u32(&count)       /* uncapped u32 */\n      posix_acl_alloc(count, GFP_KERNEL)\n      sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */\n\nThe encoder side in the same file already rejects ACLs whose a_count\nexceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit\n5fc51dfc2eb1 (\"NFSD: Add support for XDR decoding POSIX draft ACLs\")\nomitted the symmetric check.\n\nFix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with\nnfserr_inval, before any allocation, so the sort is bounded by\nNFS_ACL_MAX_ENTRIES^2 comparisons.\n\nWhile we're in here, also fix the nfserr_resource return if\nposix_acl_alloc() fails. That's not a legal error code for v4.1+. Change\nit to return nfserr_jukebox as that's more appropriate for memory\nallocation failures.\n\n## Affected\n\n- `Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < ea14d71d6ecb925673761bcf79f781f7dc9042cc`\n- `Linux >= 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 < 4bc1108e876153a2dd6d874052b99182c3603135`\n- `Linux 7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89695.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224609,"id":"CVE-2026-89695","ts":1792401436231,"field":"cvss","old":"7","new":"7.5"},{"seq":205447,"id":"CVE-2026-89695","ts":1789576718000,"field":"cvss","old":"5.3","new":"7"},{"seq":205446,"id":"CVE-2026-89695","ts":1789576718000,"field":"severity","old":"medium","new":"high"},{"seq":202816,"id":"CVE-2026-89695","ts":1789403731643,"field":"cvss","old":"7.5","new":"5.3"},{"seq":202815,"id":"CVE-2026-89695","ts":1789403731643,"field":"severity","old":"high","new":"medium"},{"seq":197730,"id":"CVE-2026-89695","ts":1789384318592,"field":"cvss","old":"5.3","new":"7.5"},{"seq":197729,"id":"CVE-2026-89695","ts":1789384318592,"field":"severity","old":"medium","new":"high"},{"seq":183345,"id":"CVE-2026-89695","ts":1789356674972,"field":"cvss","old":"7.5","new":"5.3"},{"seq":183344,"id":"CVE-2026-89695","ts":1789356674972,"field":"severity","old":"high","new":"medium"},{"seq":153576,"id":"CVE-2026-89695","ts":1789285351348,"field":"cvss","old":null,"new":"7.5"},{"seq":153575,"id":"CVE-2026-89695","ts":1789285351348,"field":"severity","old":"none","new":"high"},{"seq":147309,"id":"CVE-2026-89695","ts":1789270208767,"field":"cvss","old":null,"new":"5.3"},{"seq":147308,"id":"CVE-2026-89695","ts":1789270208767,"field":"severity","old":"none","new":"medium"},{"seq":109062,"id":"CVE-2026-89695","ts":1789183730160,"field":"cvss","old":null,"new":"5.3"},{"seq":109061,"id":"CVE-2026-89695","ts":1789183730160,"field":"severity","old":"none","new":"medium"}]}