Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89672— nfsd: gate nfs2 setacl by argp->mask

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： nfsd：通过 argp->mask 控制 nfs2 的 SETACL NFS ACL v2 的 SETACL 路径与其 v3 对应路径（nfsd3）共享相同的解码约定： 仅在请求掩码（mask）中设置了 位时，才会为 赋值；仅在设置了 位时，才会为 赋值。由于在解码前参数缓冲区被清零至 ，未设置的项对应的指针将保持为 NULL。 随后， 无条件地将这两个指针传递给 。而 在 VFS 中的语义是“移除该类型的 ACL”。因此，如果请求掩码中只设置了 而缺少 ，系统将静默地移

AI Predicted 5.3 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux a257cdd0e2179630d3201c32ba14d7fcb3c3a055< e41d173d9dc735cecb15ab7aa63ecab09338f81b affected
a257cdd0e2179630d3201c32ba14d7fcb3c3a055< f951b22dbeec46f2e0fba81cb80d1b0c686b61eb affected
a257cdd0e2179630d3201c32ba14d7fcb3c3a055< 37eea38e7898538f0ec5f1eb8b18d8646e4be41c affected
a257cdd0e2179630d3201c32ba14d7fcb3c3a055< a3a7e20ed66d3f04d37883c398da8a113b430769 affected
2.6.13 affected
< 2.6.13 unaffected
6.12.109≤ 6.12.* unaffected
6.18.50≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89672

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfsd: gate nfs2 setacl by argp->mask
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a257cdd0e2179630d3201c32ba14d7fcb3c3a055 ~ e41d173d9dc735cecb15ab7aa63ecab09338f81b -
Linux Linux 2.6.13 -

II. Public POCs for CVE-2026-89672

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89672

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89672 (4)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89491 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
CVE-2026-89477 sctp: fix NULL deref on untransmitted RECONF completion
CVE-2026-89478 sctp: drop a chunk if its transport was removed
CVE-2026-89479 sctp: stop processing a packet once its association is deleted
CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes
CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command
CVE-2026-89483 nvme: zero the discard fallback page
CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure
CVE-2026-89485 lockd: pin next file across nlm_inspect_file lock-drop
CVE-2026-89486 ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free
CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks
CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure
CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails
CVE-2026-89496 ocfs2: always run deallocs on copy-on-write completion
CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89672

No comments yet

Leave a comment