SB2026091287 - Improper Check for Unusual or Exceptional Conditions in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89693)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create objects without the requested access control lists.

The vulnerability exists due to improper handling of ACL translation errors in nfsd4_create() when processing NFSv4 CREATE requests containing ACLs. A remote attacker can submit a crafted NFSv4 CREATE request that causes ACL translation to fail to create objects without the requested access control lists.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86
• https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b
• https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528