# CVE-2026-89693

## Summary

- **CVE ID:** CVE-2026-89693
- **Severity:** UNKNOWN
- **CVSS Score:** 1.51
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

nfsd4_create() stores the return value of nfsd4_acl_to_attr() in
status, but the switch(create->cr_type) block unconditionally
overwrites it in every branch. ACL translation errors are silently
discarded, and the CREATE proceeds without the requested ACL.

Add an early exit check after nfsd4_acl_to_attr(), matching the
pattern already used in nfsd4_setattr().

[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]

## Affected Products

- Linux — Linux (c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b)
- Linux — Linux (c5409ce523af40d5c3019717bc5b4f72038d48be)
- Linux — Linux (d52acd23a327cada5fb597591267cfc09f08bb1d)
- Linux — Linux (5.10.220)
- Linux — Linux (5.15.154)
- Linux — Linux (6.0)
- Linux — Linux (0)
- Linux — Linux (6.18.51)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b)
- [CNA](https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528)
- [CNA](https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.17%
- **EPSS Percentile:** 6.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._