SB20260912115 - Improper Check for Unusual or Exceptional Conditions in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89672)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to remove POSIX ACLs.

The vulnerability exists due to improper handling of omitted ACL fields in the NFSACL v2 SETACL handler when processing SETACL requests with omitted ACL mask bits. A remote attacker can send a SETACL request with omitted ACL mask bits to remove POSIX ACLs.

A request containing only the NFS_ACL mask bit removes the directory's default ACL, while a request with a zero mask removes both ACL types.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c
• https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769
• https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b
• https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb