CVE-2026-89695: Linux Kernel POSIX ACL DOS Vulnerability

CVE-2026-89695 Overview

CVE-2026-89695 is a denial-of-service vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The nfsd4_decode_posixacl() function reads a client-supplied u32 entry count from the wire and passes it directly to posix_acl_alloc() and sort_pacl_range() without validation. Because sort_pacl_range() implements an O(n^2) bubble sort, a client-chosen count drives unbounded CPU consumption in the server's compound processing path. The encoder side already enforces NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 omitted the symmetric check. A remote, unauthenticated attacker can exhaust server CPU resources with a single crafted NFSv4 request.

Critical Impact
A remote attacker can trigger CPU exhaustion on an NFSv4 server by sending a crafted POSIX ACL with an oversized entry count, disrupting file service availability for all clients.

Affected Products

Linux kernel versions containing commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
Linux distributions shipping affected kernel versions with nfsd enabled
NFSv4.1+ file servers exposing POSIX draft ACL support

Discovery Timeline

2026-09-11 - CVE-2026-89695 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89695

Vulnerability Analysis

The vulnerability resides in the NFSv4 XDR decoder path for POSIX draft ACLs. When a client submits an ACL as part of a compound operation, nfsd4_decode_posixacl() invokes xdr_stream_decode_u32(&count) to read the entry count from the wire. The decoder passes this uncapped 32-bit value directly to posix_acl_alloc(count, GFP_KERNEL) and then to sort_pacl_range(*acl, 0, count - 1).

Because sort_pacl_range() is implemented as a bubble sort with quadratic time complexity, a client controlling the count field controls the number of comparisons performed by the server. A large count value causes the server thread to spend disproportionate CPU cycles sorting, blocking other NFS operations sharing that worker context.

The encoder in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the corresponding check was never added to the decoder. This asymmetry created the exploitable path. See the upstream fix commit for the patch.

Root Cause

The root cause is missing input validation on an attacker-controlled length field prior to invoking an algorithm with quadratic complexity. This aligns with an Algorithmic Complexity Attack and Resource Exhaustion pattern. The decoder trusted the wire-supplied count and performed no bounds check against NFS_ACL_MAX_ENTRIES before allocation or sorting.

Attack Vector

Exploitation requires network reach to a Linux NFSv4 server that has POSIX draft ACL decoding enabled. An unauthenticated remote attacker submits an NFSv4 compound request containing a POSIX ACL with a maximally large count value. The server allocates the corresponding memory and then enters the O(n^2) sort, tying up nfsd worker threads and degrading or halting file service for legitimate clients. No authentication, privileges, or user interaction are required.

No public proof-of-concept code has been verified for this issue. Refer to the vendor commit references for the exact decoder path and validation logic added by the fix.

Detection Methods for CVE-2026-89695

Indicators of Compromise

Sustained high CPU utilization on nfsd kernel threads without a corresponding increase in successful NFS operations
NFSv4 compound requests carrying POSIX ACL attributes with entry counts far exceeding NFS_ACL_MAX_ENTRIES
Client-side timeouts, NFS4ERR_DELAY, or connection resets from previously healthy NFS mounts

Detection Strategies

Monitor kernel CPU time attributed to nfsd worker threads and alert on sustained saturation of one or more cores
Inspect NFSv4 traffic for SETATTR or ACL-carrying compound operations with abnormally large POSIX ACL entry counts
Correlate spikes in nfsd CPU with concurrent drops in successful NFS RPC completion rates in host telemetry

Monitoring Recommendations

Ingest kernel, nfsd, and syslog telemetry into a centralized analytics platform and baseline normal nfsd CPU consumption per server
Track connection counts and per-client RPC rates on NFS servers to identify a single client driving anomalous load
Enable audit logging on NFS exports where POSIX ACLs are used and alert on unexpected ACL-modifying operations from untrusted subnets

How to Mitigate CVE-2026-89695

Immediate Actions Required

Apply the upstream Linux kernel patch that caps the decoded POSIX ACL count at NFS_ACL_MAX_ENTRIES and returns nfserr_inval for oversized requests
Restrict NFSv4 server exposure to trusted management and client networks using host and network firewalls
Identify all Linux hosts running nfsd and confirm kernel versions against distribution advisories

Patch Information

The fix rejects wire counts greater than NFS_ACL_MAX_ENTRIES with nfserr_inval before any allocation, bounding the sort at NFS_ACL_MAX_ENTRIES^2 comparisons. The patch also replaces the incorrect nfserr_resource return on posix_acl_alloc() failure with nfserr_jukebox, which is a legal error code for NFSv4.1+. See the Linux kernel commit and the related stable commit for the authoritative fix.

Workarounds

Limit NFSv4 access at the network layer to authenticated client subnets until patched kernels can be deployed
Where operationally feasible, disable POSIX ACL support on affected exports or migrate to NFSv4 ACLs to avoid the vulnerable decoder path
Rate-limit NFS RPC traffic per source IP at upstream network devices to reduce the impact of a single abusive client

bash

# Example: restrict nfsd exposure to a trusted subnet using nftables
nft add rule inet filter input tcp dport 2049 ip saddr != 10.0.0.0/24 drop
nft add rule inet filter input udp dport 2049 ip saddr != 10.0.0.0/24 drop