Linux kernel nfsd: uncapped POSIX ACL entry count drives an O(n^2) sort in the NFS server

Impact

nfsd4_decode_posixacl() took a client-supplied u32 entry count straight from the wire into posix_acl_alloc() and a bubble sort, so a single COMPOUND can burn unbounded CPU inside an nfsd kthread. On a shared dataset server this starves every other NFS client behind the same nfsd thread pool - which on a GPU fleet means training jobs stall on dataset and checkpoint reads across many nodes at once, not just the node that issued the request. The encoder side already enforced NFS_ACL_MAX_ENTRIES; the decoder omitted the symmetric check. Availability-only: no memory corruption or data disclosure is claimed.

Who can reach it

Any host that can mount the export and issue an NFSv4 COMPOUND. Standard NFS client authentication applies, so in practice any tenant node or pod with access to the storage VLAN, not an unauthenticated internet attacker.

What to do

Update the kernel to a build containing the fix (commits 4bc1108e8761 and ea14d71d6ecb in stable) and reboot the NFS server node. If the server is a dedicated storage head, this is one reboot with a client-visible pause; there is no module reload path for nfsd on a live export. Until then, restrict export access to known client subnets - no upstream mitigation is documented.

References

Related entries

• Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsdCVE-2026-89696 · Linux kernel nfsd (inter-server COPY, NFSD4_FH_FOREIGN compound dispatch)High
• Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND opCVE-2026-89699 · Linux kernel nfsd (NFSv4 CREATE symlink decoder, cr_datalen)High
• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High
• Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost dataCVE-2026-89706 · Linux kernel nfsd (async COPY write verifier rotation, nn->writeverf)High
• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High