# CVE-2026-89672

## Summary

- **CVE ID:** CVE-2026-89672
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its
v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access
only when NFS_ACL is set in the request mask and argp->acl_default
only when NFS_DFACL is set, leaving the other pointer NULL because
the argument buffer is zeroed up to pc_argzero before decode.

nfsacld_proc_setacl() then hands both pointers to set_posix_acl()
unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS
"remove this ACL type" operation, so an omitted arm is
indistinguishable from an explicit request to delete that ACL. A
SETACL carrying only NFS_ACL silently strips the directory's default
ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3_proc_setacl(); apply the
same remedy. Gate each set_posix_acl() call on its mask bit and
initialize error to 0 so that a request with neither bit set leaves
the on-disk ACLs untouched and returns success. The out_drop_lock
path and the unconditional posix_acl_release() in
nfsaclsvc_release_setacl() already tolerate the skipped arms.

## Affected Products

- Linux — Linux (a257cdd0e2179630d3201c32ba14d7fcb3c3a055)
- Linux — Linux (2.6.13)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b)
- [CNA](https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb)
- [CNA](https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c)
- [CNA](https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769)
- [CNA](https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.52%
- **EPSS Percentile:** 43.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._