---
id: CVE-2026-89672
title: 'nfsd: gate nfs2 setacl by argp->mask'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: gate nfs2 setacl by argp->mask

  The NFSACL v2 SETACL path shares the decoder convention used by its
  v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_a…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-266
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <
    8e4422b05f410f95c51b68a0db4bf1d87f6d22f5
  - >-
    Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <
    e41d173d9dc735cecb15ab7aa63ecab09338f81b
  - >-
    Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <
    f951b22dbeec46f2e0fba81cb80d1b0c686b61eb
  - >-
    Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <
    37eea38e7898538f0ec5f1eb8b18d8646e4be41c
  - >-
    Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <
    a3a7e20ed66d3f04d37883c398da8a113b430769
  - Linux 2.6.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:25:46.874632Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:45.617Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89672'
references:
  - url: 'https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5'
  - url: 'https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b'
  - url: 'https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb'
  - url: 'https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c'
  - url: 'https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89672.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89672'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532465'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89672'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89672'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89672.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00523
epssPercentile: 0.44173
scores:
  cna: 9.1
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its
v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access
only when NFS_ACL is set in the request mask and argp->acl_default
only when NFS_DFACL is set, leaving the other pointer NULL because
the argument buffer is zeroed up to pc_argzero before decode.

nfsacld_proc_setacl() then hands both pointers to set_posix_acl()
unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS
"remove this ACL type" operation, so an omitted arm is
indistinguishable from an explicit request to delete that ACL. A
SETACL carrying only NFS_ACL silently strips the directory's default
ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3_proc_setacl(); apply the
same remedy. Gate each set_posix_acl() call on its mask bit and
initialize error to 0 so that a request with neither bit set leaves
the on-disk ACLs untouched and returns success. The out_drop_lock
path and the unconditional posix_acl_release() in
nfsaclsvc_release_setacl() already tolerate the skipped arms.

## Affected

- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 8e4422b05f410f95c51b68a0db4bf1d87f6d22f5`
- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < e41d173d9dc735cecb15ab7aa63ecab09338f81b`
- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < f951b22dbeec46f2e0fba81cb80d1b0c686b61eb`
- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 37eea38e7898538f0ec5f1eb8b18d8646e4be41c`
- `Linux >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < a3a7e20ed66d3f04d37883c398da8a113b430769`
- `Linux 2.6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89672.json)