CVE-2026-89672: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89672 Overview

CVE-2026-89672 is a Linux kernel vulnerability in the NFS server (nfsd) NFSACL v2 SETACL code path. The decoder nfsaclsvc_decode_setaclargs() populates argp->acl_access and argp->acl_default only when the corresponding NFS_ACL or NFS_DFACL mask bits are set. However, nfsacld_proc_setacl() forwards both pointers to set_posix_acl() unconditionally. Because set_posix_acl(idmap, dentry, type, NULL) is the VFS operation to remove an ACL, an omitted arm silently deletes the corresponding on-disk ACL.

Critical Impact
A remote NFSv2 client can silently strip a directory's default or access POSIX ACLs by issuing a SETACL request with a partial or zero mask, degrading access control integrity across shared filesystems.

Affected Products

Linux kernel nfsd subsystem serving NFSACL v2
Distributions shipping affected stable kernels prior to the referenced fix commits
NFS servers exporting filesystems with POSIX ACL support enabled

Discovery Timeline

2026-09-11 - CVE-2026-89672 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89672

Vulnerability Analysis

The defect lives in the NFSACL v2 SETACL server path. The decoder honors the request mask and populates only the ACL pointers requested by the client. The argument buffer is zeroed up to pc_argzero before decoding, so any unrequested pointer stays NULL. Downstream, nfsacld_proc_setacl() calls set_posix_acl() for both the access and default ACL arms without checking the mask.

Because set_posix_acl() interprets a NULL ACL argument as a request to remove that ACL type, an omitted arm becomes indistinguishable from an explicit deletion. A client sending SETACL with only NFS_ACL set removes the directory's default ACL. A request with mask=0 removes both the access and default ACLs. This mirrors an equivalent defect previously corrected in nfsd3_proc_setacl() for NFSv3.

Root Cause

The root cause is missing input-gating between the RPC decoder and the VFS ACL setter. The decoder communicates intent through the mask field, but the server proc handler treats a NULL ACL pointer as a valid deletion command rather than as "not requested." This is an improper input validation flaw affecting the boundary between protocol decode and VFS state changes.

Attack Vector

An attacker with network reach to the NFS server and permission to issue SETACL on a target inode can send a crafted NFSACL v2 SETACL RPC. By setting mask bits selectively or clearing them entirely, the attacker triggers unintended ACL removal. The result is silent integrity loss on the target directory's POSIX ACLs, which can broaden access to files previously restricted by the default ACL inherited by newly created children.

The fix gates each set_posix_acl() invocation on its corresponding mask bit and initializes the return status to 0 so a request with neither bit set is treated as a no-op success. See the upstream fixes: Kernel Git Commit 37eea38, Kernel Git Commit 8e4422b, Kernel Git Commit a3a7e20, Kernel Git Commit e41d173, and Kernel Git Commit f951b22.

Detection Methods for CVE-2026-89672

Indicators of Compromise

Unexpected disappearance of default POSIX ACLs on NFS-exported directories, observable via getfacl returning no default: entries where they previously existed.
NFSACL v2 SETACL RPCs from unexpected clients recorded in packet captures or rpcdebug traces.
New files created under previously-restricted directories inheriting only mode bits rather than the expected default ACL.

Detection Strategies

Baseline the ACLs of exported directories and periodically compare with getfacl -R to identify silent ACL removal.
Enable NFS server auditing or auditd rules on ACL-bearing paths to record SETACL activity and correlate with client IPs.
Inspect network telemetry for NFSACL program 100227 v2 SETACL calls originating from non-administrative clients.

Monitoring Recommendations

Alert on high rates of NFS SETACL operations, especially those carrying a zero or single-bit mask.
Monitor kernel version and package inventory for hosts still running unpatched nfsd builds.
Track integrity changes to /etc/exports and exported filesystem ACL state through file integrity monitoring.

How to Mitigate CVE-2026-89672

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and reboot NFS servers.
Restrict NFS export access to trusted client subnets using /etc/exports host restrictions and firewall rules.
Audit current POSIX ACLs on exported filesystems and restore any that were silently removed from backups.

Patch Information

The fix gates each set_posix_acl() call in nfsacld_proc_setacl() on its corresponding mask bit (NFS_ACL, NFS_DFACL) and initializes the error variable to 0. Stable-tree commits addressing the issue include 37eea38e7898, 8e4422b05f41, a3a7e20ed66d, e41d173d9dc7, and f951b22dbeec. Rebuild and deploy kernels containing these commits or upgrade to distribution kernels that include the backports.

Workarounds

Disable the NFSACL sideband protocol by unloading or not configuring the nfs_acl service where POSIX ACL propagation over NFS is not required.
Export filesystems with no_acl where feasible to prevent ACL manipulation via NFS.
Constrain the NFS server to NFSv4 only, since the flaw is specific to the NFSACL v2 SETACL path.

bash

# Example: restrict exports and disable legacy NFS versions in /etc/nfs.conf
[nfsd]
vers2=n
vers3=n
vers4=y
# Reload the NFS server after changes
# systemctl restart nfs-server