CVE-2026-89672 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: gate nfs2 setacl by argp->mask
The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode.
nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both.
This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified as CVE-2024-something (specifically related to NFSv2 SETACL handling) represents a critical logic error within the Linux kernel's Network File System server implementation, specifically in the nfsd component. This flaw stems from an incorrect assumption about how access control lists are processed when specific mask bits are absent in client requests. The vulnerability affects the NFSv2 protocol handler for setting ACLs, where the decoder function nfsaclsvc_decode_setaclargs correctly populates pointers to ACL structures only if corresponding flags such as NFS_ACL or NFS_DFACL are set in the request mask. However, the subsequent processing routine nfsacld_proc_setacl fails to respect these conditions and unconditionally passes potentially NULL pointers to the VFS layer function set_posix_acl. This architectural oversight creates a dangerous ambiguity where an omitted ACL type is treated identically to an explicit instruction to remove that specific ACL from the filesystem object.
From a technical perspective, the core defect lies in the unconditional invocation of set_posix_acl with a NULL pointer for either the access or default ACL structure. In the Linux Virtual File System layer, passing a NULL pointer to this function is defined as a command to delete the specified type of POSIX ACL associated with the dentry. Consequently, when an NFSv2 client sends a SETACL request that includes only the NFS_ACL flag but omits the NFS_DFACL flag, the decoder leaves the default ACL pointer as NULL. The server then interprets this NULL value not merely as an absence of data to update, but as a directive to strip the existing default ACL from the directory or file. Similarly, if both flags are absent in the mask, resulting in both pointers being NULL, the operation results in the deletion of both access and default ACLs entirely. This behavior is fundamentally incorrect because it violates the principle that unset fields should be ignored rather than acted upon as destructive commands.
The operational impact of this vulnerability is severe for systems relying on NFSv2 for file sharing, particularly those utilizing POSIX extended attributes for security policies. An attacker or a misconfigured client can inadvertently or maliciously trigger the removal of critical access control lists by sending SETACL requests with specific mask configurations that omit certain flags. For instance, if an administrator expects to update only the user permissions while leaving group and other permissions intact via default ACLs, this bug would cause those default rules to be wiped out. This leads to a significant degradation in security posture, potentially exposing sensitive files or directories to unauthorized access by users who were previously restricted by the now-deleted ACL entries. The impact is compounded by the fact that NFSv2 is often used in legacy environments where robust auditing and monitoring might be less prevalent, allowing such destructive actions to go unnoticed until data integrity issues arise.
This issue mirrors a similar defect found in the NFSv3 implementation, which was previously addressed but left the v2 path vulnerable due to code duplication or parallel maintenance of protocol handlers. The remediation involves gating each call to set_posix_acl behind checks for their respective mask bits, ensuring that deletion only occurs if explicitly requested by setting both flags appropriately rather than relying on NULL pointers as a signal. Additionally, initializing error codes correctly ensures that requests with no valid ACL updates return success without modifying the filesystem state. This fix aligns with standard security practices regarding input validation and explicit intent handling in system calls. From an industry standards perspective, this vulnerability can be categorized under CWE-94 Improper Control of Generation of Code Command Injection or more accurately CWE-823 Use of Out-of-range Pointer Offset if viewed through the lens of memory safety, but primarily it falls under CWE-605 Multiple Bindings to a Single Endpoint leading to Confused Deputy scenarios where the server misinterprets client intent. In terms of MITRE ATT&CK, this could be associated with T1222 File and Directory Permissions Modification, as an attacker can alter permissions by exploiting this logic flaw to strip ACLs. Mitigation requires applying kernel patches that enforce strict mask-based conditional execution for ACL operations in the NFS server module, ensuring that only explicitly requested changes are applied while preserving existing security configurations when fields are omitted.