CVE-2026-89672

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89672", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.746Z", "datePublished": "2026-09-11T19:45:57.414Z", "dateUpdated": "2026-10-30T12:32:37.687Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:32:37.687Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.\nAC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.\nPR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.\nUI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.\nS:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.\nI:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.\nA:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs2acl.c"], "versions": [{"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "d00a2f81ba7c57045bd644971ddb6961c5efe3e0", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "760e7a4f92f597c61ab6b089f934a7e3acf238b7", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "54ff9c81d6b77de4540ba33a3b4d613ce3194863", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "8e4422b05f410f95c51b68a0db4bf1d87f6d22f5", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs2acl.c"], "versions": [{"version": "2.6.13", "status": "affected"}, {"version": "0", "lessThan": "2.6.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0"}, {"url": "https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7"}, {"url": "https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863"}, {"url": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"}, {"url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"}, {"url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"}, {"url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"}, {"url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}], "title": "nfsd: gate nfs2 setacl by argp->mask", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:46.874632Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:48.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:46.874632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:25:47.931Z"}}], "cna": {"title": "nfsd: gate nfs2 setacl by argp->mask", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.\nAC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.\nPR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.\nUI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.\nS:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.\nI:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.\nA:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "d00a2f81ba7c57045bd644971ddb6961c5efe3e0", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "760e7a4f92f597c61ab6b089f934a7e3acf238b7", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "54ff9c81d6b77de4540ba33a3b4d613ce3194863", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "8e4422b05f410f95c51b68a0db4bf1d87f6d22f5", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "versionType": "git"}, {"status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769", "versionType": "git"}], "programFiles": ["fs/nfsd/nfs2acl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.13"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.273", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.224", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/nfs2acl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0"}, {"url": "https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7"}, {"url": "https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863"}, {"url": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"}, {"url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"}, {"url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"}, {"url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"}, {"url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.273", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.224", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.157", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "2.6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "2.6.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:32:37.687Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89672", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:32:37.687Z", "dateReserved": "2026-09-11T19:38:34.746Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:45:57.414Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs2acl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d00a2f81ba7c57045bd644971ddb6961c5efe3e0", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "760e7a4f92f597c61ab6b089f934a7e3acf238b7", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "54ff9c81d6b77de4540ba33a3b4d613ce3194863", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "8e4422b05f410f95c51b68a0db4bf1d87f6d22f5", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs2acl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.13"}, {"lessThan": "2.6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}], "id": "CVE-2026-89672", "lastModified": "2026-10-30T13:20:25.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89672", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:25:46.874632Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:53.770", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: nfsd allows unauthorized modification of Access Control Lists (ACLs)", "id": "2532465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532465"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in the Linux kernel's Network File System (NFS) server daemon (`nfsd`). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both access and default ACLs. This occurs because the `set_posix_acl()` function is called unconditionally, even if the request mask indicates that no ACLs should be set, leading to an unintended removal operation. This could allow an attacker to modify file system permissions without authorization."], "name": "CVE-2026-89672", "public_date": "2026-09-11T19:45:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89672\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89672\nhttps://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c\nhttps://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769\nhttps://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b\nhttps://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,e41d173d9dc735cecb15ab7aa63ecab09338f81b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,f951b22dbeec46f2e0fba81cb80d1b0c686b61eb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,37eea38e7898538f0ec5f1eb8b18d8646e4be41c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,a3a7e20ed66d3f04d37883c398da8a113b430769)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T08:45:11.058280+00:00", "updated": "2026-09-15T20:30:10.349489+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}