CVE-2026-89671

A flaw was found in the Linux kernel's Network File System version 3 (NFSv3) server daemon (nfsd). The nfsd3_proc_setacl() function unconditionally processes Access Control List (ACL) update requests, even when the client's request does not specify an ACL to be set. A remote attacker could exploit this by sending a crafted SETACL request, leading to the unintended removal of a directory's default ACL or both access and default ACLs. This could result in unauthorized changes to file system permissions.

NFSv3 SETACL handling in nfsd can silently remove POSIX ACLs because missing ACL arms are represented as NULL pointers, and set_posix_acl interprets NULL as a request to delete that ACL type. A remote authenticated NFS client can trigger this by sending a SETACL request where the mask omits NFS_ACL or NFS_DFACL, causing the server to remove an access ACL or a default ACL that the client did not explicitly provide. For the CVSS the PR:L is used because the attacker needs network access to the NFS export and enough user level authorization to issue SETACL against the target object, but administrator privileges are not normally required for owned files or directories. The issue is network reachable through the NFS control path and is not triggered by local kernel code execution. Impact is an access control policy bypass that can affect confidentiality and integrity of shared files, especially on multi user NFS exports where default ACL inheritance is used to enforce security policy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.