CVE-2026-89671: Linux Kernel NFSv3 ACL Privilege Escalation

CVE-2026-89671 Overview

CVE-2026-89671 is a Linux kernel vulnerability in the NFS server (nfsd) NFSv3 ACL handling path. The nfsd3_proc_setacl() function calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, without first checking the request's mask bits. Because set_posix_acl() treats a NULL ACL pointer as a directive to remove the ACL, a remote NFSv3 client can silently drop server-side ACLs by sending a SETACL request with mask=NFS_ACL or mask=0. The flaw affects file integrity and access control on NFSv3-exported filesystems.

Critical Impact
Remote NFSv3 clients can strip POSIX ACLs from server-exported directories, breaking access control policies and exposing files to unintended users.

Affected Products

Linux kernel with nfsd NFSv3 ACL support enabled
Systems exporting filesystems via NFSv3 with POSIX ACL support
Distributions shipping kernels prior to the fix commits (3be1d86, 453d719, 68a80b2, b3bff82, ff99ed0)

Discovery Timeline

2026-09-11 - CVE-2026-89671 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89671

Vulnerability Analysis

The vulnerability resides in the NFSv3 SETACL server-side handler nfsd3_proc_setacl() in the Linux kernel's nfsd subsystem. The NFSv3 ACL protocol uses a bitmask (argp->mask) to indicate which ACL types the client is transmitting: NFS_ACL for access ACLs and NFS_DFACL for default ACLs. The decoder nfs3svc_decode_setaclargs() only populates argp->acl_access and argp->acl_default when the corresponding mask bit is set. Otherwise those pointers remain NULL (pointing to pc_argzero).

The handler failed to consult the mask before invoking set_posix_acl(). In the VFS layer, passing a NULL ACL to set_posix_acl(idmap, dentry, type, NULL) is the operation to remove the ACL of that type. As a result, an unset arm and an explicit removal request became indistinguishable on the server.

Root Cause

The root cause is missing input validation in nfsd3_proc_setacl() — the function does not gate its calls to set_posix_acl() on the argp->mask bits. The sibling nfsd3_proc_getacl() already checks the mask before touching each arm, and that pattern was not mirrored in the setter. This falls under improper input validation and a semantic ambiguity between "field omitted" and "field set to remove".

Attack Vector

An NFSv3 client with the ability to submit SETACL requests to an affected NFS server can send a crafted request with mask=NFS_ACL to silently drop the target directory's default ACL, or with mask=0 to drop both the access and default ACLs. No authentication beyond normal NFS export access is required, and no user interaction is involved. Because ACLs commonly enforce fine-grained access restrictions, their silent removal can broaden effective permissions and undermine directory access controls. See the upstream fix commits for the corrected mask-gating logic: Kernel Commit 3be1d86, Kernel Commit 453d719, Kernel Commit 68a80b2, Kernel Commit b3bff82, and Kernel Commit ff99ed0.

Detection Methods for CVE-2026-89671

Indicators of Compromise

Unexpected disappearance of POSIX access or default ACLs on NFSv3-exported directories, verifiable with getfacl against a known-good baseline.
NFSv3 SETACL RPC traffic to the server carrying mask values of 0 or NFS_ACL only, without a corresponding NFS_DFACL bit when default ACLs previously existed.
Audit log entries showing ACL changes on exported directories that do not correlate with administrative activity.

Detection Strategies

Deploy Linux audit rules (auditctl -w <exported_path> -p a) on NFS-exported directories to record ACL modifications and correlate with client source addresses.
Capture and inspect NFSv3 ACL RPC procedures (program 100227, procedure SETACL) at the network layer to identify anomalous mask values from client peers.
Periodically diff getfacl -R snapshots of exported trees against a trusted baseline to identify silent ACL removals.

Monitoring Recommendations

Forward NFS server audit logs and ACL-change events into a centralized SIEM or data lake for continuous correlation across hosts.
Alert on NFSv3 SETACL operations originating from clients that historically do not modify ACLs.
Track kernel package versions across the fleet to identify hosts running unpatched nfsd builds.

How to Mitigate CVE-2026-89671

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits (3be1d86, 453d719, 68a80b2, b3bff82, ff99ed0) and reboot affected NFS servers.
Restrict NFSv3 exports to trusted client networks using /etc/exports host restrictions and firewall rules on ports 2049 and the NFS ACL sideband.
Back up current ACLs on exported filesystems with getfacl -R before patching to enable rapid restoration if tampering is discovered.

Patch Information

The fix wraps each set_posix_acl() call in nfsd3_proc_setacl() with the matching argp->mask bit check and initializes error to 0 before inode_lock, so a request with neither bit set leaves on-disk ACLs untouched and returns nfs_ok. Patched kernels are available via the upstream stable trees referenced by commits 3be1d86, 453d719, 68a80b2, b3bff82, and ff99ed0. Consult your distribution's security advisories for backported package versions.

Workarounds

Disable NFSv3 ACL support on the server if not required, forcing clients to use NFSv4 which uses a distinct ACL model unaffected by this bug.
Limit NFSv3 exports to ro (read-only) where write access is not needed, preventing SETACL from succeeding.
Use host-based ACLs in /etc/exports to restrict which clients can submit SETACL requests until kernels are patched.

bash

# Configuration example: restrict NFSv3 export to trusted host, read-only
# /etc/exports
/srv/nfs/share    10.0.0.0/24(ro,sync,no_subtree_check)

# Apply changes
exportfs -ra

# Verify kernel version includes the fix
uname -r