{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89672", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.746Z", "datePublished": "2026-09-11T19:45:57.414Z", "dateUpdated": "2026-09-11T19:45:57.414Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:45:57.414Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs2acl.c"], "versions": [{"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "status": "affected", "versionType": "git"}, {"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs2acl.c"], "versions": [{"version": "2.6.13", "status": "affected"}, {"version": "0", "lessThan": "2.6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.13", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"}, {"url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"}, {"url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"}, {"url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}], "title": "nfsd: gate nfs2 setacl by argp->mask", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs2acl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e41d173d9dc735cecb15ab7aa63ecab09338f81b", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}, {"lessThan": "a3a7e20ed66d3f04d37883c398da8a113b430769", "status": "affected", "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs2acl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.13"}, {"lessThan": "2.6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms."}], "id": "CVE-2026-89672", "lastModified": "2026-09-11T20:19:53.770", "metrics": {}, "published": "2026-09-11T20:19:53.770", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: nfsd allows unauthorized modification of Access Control Lists (ACLs)", "id": "2532465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532465"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in the Linux kernel's Network File System (NFS) server daemon (`nfsd`). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both access and default ACLs. This occurs because the `set_posix_acl()` function is called unconditionally, even if the request mask indicates that no ACLs should be set, leading to an unintended removal operation. This could allow an attacker to modify file system permissions without authorization."], "name": "CVE-2026-89672", "public_date": "2026-09-11T19:45:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89672\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89672\nhttps://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c\nhttps://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769\nhttps://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b\nhttps://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb"], "threat_severity": "Moderate"}

{"created": "2026-09-12T08:45:11.058280+00:00", "updated": "2026-09-12T15:30:16.635331+00:00", "vendors": []}