Linux nfsd: ACL translation errors in NFSv4 CREATE are discarded and the file is created without the requested ACL

Impact

nfsd4_create() stored the return value of nfsd4_acl_to_attr() in status, but every branch of the switch on create->cr_type overwrote it unconditionally. An ACL that fails translation is silently dropped and the CREATE succeeds anyway, so the client believes it created a file with a restrictive ACL while the server created it with only the fallback mode bits. On a shared export that is a quiet access-control weakening: a tenant or job that relies on ACLs to keep a dataset or checkpoint directory private can end up with a file more readable than intended, and nothing in the protocol response says so. The fix adds an early exit after nfsd4_acl_to_attr(), matching the pattern already used in nfsd4_setattr(), returning NFS4ERR_BADTYPE instead of proceeding.

Who can reach it

Any authenticated NFSv4 client creating a file with an ACL the server cannot translate. Not directly attacker-controlled in a useful way - the risk is to the client that requested the ACL, whose files end up less protected than requested.

What to do

Patch the kernel on in-kernel NFS server nodes and reboot. Independently of the patch, audit permissions on files created with NFSv4 ACLs on shared exports - the fix stops new occurrences but does not repair files already created without their ACL.

References

Related entries

• Linux nfsd: any authenticated NFSv4.2 client can cancel and free another client's copy-notify stateidCVE-2026-89694 · Linux kernel nfsd (NFSv4.2 copy-notify stateid)Unscored
• Linux nfsd: unprivileged netlink dump leaks 8 bytes of rq_flags and truncates IPv6 client addressesCVE-2026-89698 · Linux kernel nfsd (NFSD_CMD_RPC_STATUS_GET netlink, nfsd_genl_rqstp)Unscored
• Linux nfsd: NFSD_A_SOCK_ADDR has no minimum length, giving a 12-byte out-of-bounds read in listener_setCVE-2026-89700 · Linux kernel nfsd (nfsd_nl_listener_set_doit, NFSD_A_SOCK_ADDR netlink policy)Unscored
• Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to diskCVE-2026-89701 · Linux kernel nfsd (TIME_DELEG_ACCESS/TIME_DELEG_MODIFY nseconds decode)Unscored
• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored
• Linux NFS localio: reference leak on nfs_uuid_add_file failure pins an nfsd_file and blocks netns teardownCVE-2026-89715 · Linux kernel NFS localio (nfs_open_local_fh error path, nfs_uuid_add_file)Unscored