CVE-2026-89693: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89693 Overview

CVE-2026-89693 is a logic flaw in the Linux kernel NFS server (nfsd). The nfsd4_create() function stores the return value of nfsd4_acl_to_attr() in a status variable. The subsequent switch(create->cr_type) block then unconditionally overwrites that variable in every branch. As a result, Access Control List (ACL) translation errors are silently discarded, and the CREATE operation proceeds without the requested ACL. This causes NFSv4 file creation requests to complete without applying the caller-supplied ACL, breaking the security expectations of clients that rely on ACL enforcement at object creation time.

Critical Impact
NFSv4 CREATE operations may succeed with weaker permissions than the client requested, resulting in files created without their intended ACLs.

Affected Products

Linux kernel nfsd (NFSv4 server) subsystem
Distributions shipping vulnerable stable kernel branches prior to backport of commits 2c79127, 430ed49, and 80cebb0
NFSv4 file servers exporting filesystems that rely on client-supplied ACLs

Discovery Timeline

2026-09-11 - CVE-2026-89693 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89693

Vulnerability Analysis

The defect resides in the NFSv4 CREATE path handled by nfsd4_create() in the Linux kernel NFS server. The function calls nfsd4_acl_to_attr() to translate the NFSv4 ACL supplied by the client into the kernel's internal representation. The translation result is stored in a local status variable so the caller can propagate an NFS-level error when translation fails.

Immediately after this assignment, the function enters a switch(create->cr_type) block that dispatches on the object type being created. Every branch in the switch writes to status unconditionally, overwriting any prior error from nfsd4_acl_to_attr(). The CREATE therefore proceeds even when ACL translation failed, and the created object is left without the requested ACL. Clients receive a success response for an operation that did not honor their security intent.

The fix adds an early exit after nfsd4_acl_to_attr() and returns NFS4ERR_BADTYPE on translation failure, mirroring the existing pattern in nfsd4_setattr().

Root Cause

The root cause is an unchecked function return value combined with variable reuse across control-flow branches [CWE-252-class logic error]. The status slot is repurposed before the ACL translation error is acted on, so a real error is masked by later assignments. This is a business-logic and input-validation flaw in the CREATE handler rather than a memory-safety bug.

Attack Vector

A local or remote NFSv4 client with permission to issue CREATE operations against an export can trigger the path by sending a CREATE that includes an ACL attribute the server cannot translate. The server returns success and creates the object without the requested ACL. Depending on the umask and default permissions of the target directory, the resulting object may be more permissive than the client intended, enabling unauthorized read or write access by other principals with access to the export.

No verified public proof-of-concept is available. See the upstream commits for the exact code change: Kernel commit 2c79127, Kernel commit 430ed49, and Kernel commit 80cebb0.

Detection Methods for CVE-2026-89693

Indicators of Compromise

Files or directories created via NFSv4 that lack the ACLs the client requested, discovered through periodic ACL audits of exported filesystems.
NFSv4 CREATE operations returning NFS4_OK on servers whose kernel version predates the patched commits, despite clients supplying ACL attributes.
Unexpected access to newly created objects by principals that should have been denied by the intended ACL.

Detection Strategies

Compare the effective ACL on files created through NFSv4 to the ACL the client supplied in the CREATE call using packet captures or NFS server tracing (rpc.svcgssd, rpcdebug -m nfsd).
Inventory kernel versions across NFS servers and flag hosts running nfsd without the patch commits 2c79127, 430ed49, or 80cebb0.
Enable NFSv4 audit logging where available and correlate CREATE operations with subsequent access events to identify permission drift.

Monitoring Recommendations

Monitor kernel package inventory on all Linux NFS servers and alert on hosts running unpatched stable branches.
Track NFSv4 CREATE operation counts and error rates to establish a baseline and detect anomalies after upgrades.
Audit permissions on directories that are frequent CREATE targets and alert when new objects deviate from the expected ACL template.

How to Mitigate CVE-2026-89693

Immediate Actions Required

Identify all Linux systems running the in-kernel NFSv4 server (nfsd) and record their kernel versions.
Apply the stable kernel update containing commits 2c79127, 430ed49, and 80cebb0 from your distribution.
Reboot affected NFS servers after patching so the corrected nfsd module is loaded.
Audit ACLs on recently created objects across NFSv4 exports and remediate any that deviate from policy.

Patch Information

The fix adds an early exit check after nfsd4_acl_to_attr() in nfsd4_create() and returns NFS4ERR_BADTYPE when ACL translation fails, matching the pattern used in nfsd4_setattr(). Apply the upstream stable commits: Kernel commit 2c79127, Kernel commit 430ed49, and Kernel commit 80cebb0. Consult your distribution's advisory for the exact package version that carries these backports.

Workarounds

Restrict NFSv4 export access to trusted clients using /etc/exports host lists and firewall rules on TCP/UDP port 2049 until the kernel patch is applied.
Set restrictive default permissions and umasks on parent directories so that objects created without their intended ACLs are not world-accessible.
Where feasible, disable NFSv4 ACL support on exports that do not require it, forcing clients to rely on POSIX mode bits until patching is complete.

bash

# Example: verify running kernel and NFS server status before/after patching
uname -r
rpm -q kernel   # or: dpkg -l | grep linux-image
systemctl status nfs-server

# Restrict an export to a known client subnet as a temporary control
# /etc/exports
# /srv/nfs4  10.0.0.0/24(rw,sec=sys,no_subtree_check)
exportfs -ra