CVE-2026-89693

A flaw was found in the Linux kernel's Network File System (NFS) daemon, nfsd. This vulnerability arises from improper error handling within the nfsd4_create() function, which is responsible for creating files and directories. When Access Control Lists (ACLs) are translated, any errors are silently discarded, allowing the creation process to proceed without applying the requested access restrictions. This could lead to an access control bypass, potentially granting unauthorized users unintended access to sensitive resources.

NFSv4 CREATE handling in nfsd4_create() can silently ignore an ACL translation error from nfsd4_acl_to_attr() because the saved status is overwritten by later object type handling. A remote NFS client that is allowed to create objects in an export can request an ACL that fails translation and still get the object created without the requested ACL. This can weaken the intended access control policy for files or special objects on a shared NFS export and may allow unintended read or write access depending on mode bits, default ACLs, export policy, and local users. For the CVSS the PR:L is used because the client normally needs valid NFS access and create permission on the target export. The issue is network reachable through the NFS server control path for CREATE operations. Impact is primarily confidentiality and integrity loss from ACL policy bypass, not kernel memory corruption or DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.