Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACL

Impact

The NFSACL decoders fill acl_access only when NFS_ACL is set in the request mask and acl_default only when NFS_DFACL is set, leaving the other pointer NULL. The SETACL proc handlers pass both to set_posix_acl() unconditionally, and set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation - so an omitted arm is indistinguishable from an explicit delete. A SETACL carrying only NFS_ACL silently strips a directory's default ACL; mask=0 strips both. On a shared dataset export this is an access-control change the client never asked for: newly created files under that directory stop inheriting the intended ACL, which can widen access for other tenants and is not visible until someone audits the ACLs. The kernel split this across two ids, one for the NFSv3 handler and one for the NFSv2 handler, with the same fix and the same remediation.

Who can reach it

Any client that can mount the export and issue an NFSACL SETACL, under normal export authentication. Also triggered unintentionally by well-behaved clients that set only one ACL arm.

What to do

Upgrade to a stable kernel containing the referenced commits and reboot the NFS server after draining clients. Both ids are fixed by the same change set. Audit default ACLs on exported directories that clients have set ACLs on, since the patch does not restore ACLs that were already dropped. The record gives commits only, no fixed release numbers.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored
• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored
• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored