CVE-2026-89672

A flaw was found in the Linux kernel's Network File System (NFS) server daemon (nfsd). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both access and default ACLs. This occurs because the set_posix_acl() function is called unconditionally, even if the request mask indicates that no ACLs should be set, leading to an unintended removal operation. This could allow an attacker to modify file system permissions without authorization.

NFSACL v2 SETACL handling can remove POSIX ACLs that were not present in the request because missing ACL pointers are passed as NULL to set_posix_acl, where NULL means delete this ACL type. A remote NFS client can trigger this through the NFSACL SETACL procedure by sending a mask that contains only one ACL arm or no ACL arm, causing the omitted access ACL or default ACL to be removed. For the CVSS the PR:L is used because the attacker normally needs valid NFS credentials and permission to perform SETACL on the target export or object. The issue is network reachable when the NFS ACL service is exposed to the client network. Impact is an access control policy bypass with possible confidentiality and integrity impact, especially on shared exports where default ACLs control permissions inherited by newly created files and directories.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.