PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89672 Linux CVE debrief

A vulnerability in the Linux kernel's nfsd component has been addressed. The NFSACL v2 SETACL path did not properly gate the setting of ACLs based on the request mask, potentially leading to unintended ACL removal. This issue has been resolved by applying the same fix used in nfsd3_proc_setacl. The vulnerability allowed an attacker to silently strip the directory's default ACL or both ACL types if the mask was set to 0. Linux system administrators and security teams should assess exposure and apply patches or updates to prevent unintended ACL modifications.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-19
Advisory published
2026-09-11
Advisory updated
2026-10-19

Who should care

Linux system administrators and security teams should assess exposure and apply patches or updates to prevent unintended ACL modifications. This vulnerability in the Linux kernel's nfsd component could lead to unintended ACL modifications if not properly patched. Verify ACL configuration and system logs for potential issues and monitor system configurations to prevent similar vulnerabilities.

Why it matters

This vulnerability in the Linux kernel's nfsd component could lead to unintended ACL modifications if not properly patched. Linux system administrators and security teams should assess exposure and apply necessary updates.

  • Verify ACL configuration and system logs for potential issues
  • Apply patches or updates to prevent unintended ACL removal
  • Monitor system configurations to prevent similar vulnerabilities

Technical summary

The Linux kernel's nfsd component had a vulnerability where the NFSACL v2 SETACL path did not properly gate ACL setting based on the request mask. This could lead to unintended removal of ACLs. The issue has been addressed by applying a fix similar to that used in nfsd3_proc_setacl. The fix involves gating each set_posix_acl() call on its mask bit and initializing error to 0. This ensures that a request with neither bit set leaves the on-disk ACLs untouched and returns success. Linux system administrators and security teams should assess exposure and apply necessary updates.

Defensive priority

Apply patches or updates from the Linux vendor to ensure the nfsd component is properly handling ACL requests.

Recommended defensive actions

  • Review and apply Linux kernel updates to ensure nfsd is patched
  • Verify system configurations to prevent unintended ACL modifications
  • Monitor system logs for potential ACL-related issues
  • Apply patches or updates from the Linux vendor to ensure the nfsd component is properly handling ACL requests
  • Verify ACL configuration and system logs for potential issues
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and associated source item provide details on the vulnerability and its resolution in the Linux kernel. Supplemental sources offer additional context and technical details. The vulnerability was addressed by gating each set_posix_acl() call on its mask bit and initializing error to 0. This ensures that a request with neither bit set leaves the on-disk ACLs untouched and returns success.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89672 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89672

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89672 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89672

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • nfsd: gate nfs2 setacl by argp->mask

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89672.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.