Answer in brief
CVE-2026-89672 records a Critical severity (CVSS 9.1) vulnerability in nfsd: gate nfs2 setacl by argp->mask. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <e41d173d9dc735cecb15ab7aa63ecab09338f81b || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <f951b22dbeec46f2e0fba81cb80d1b0c686b61eb || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <37eea38e7898538f0ec5f1eb8b18d8646e4be41c || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <a3a7e20ed66d3f04d37883c398da8a113b430769 | e41d173d9dc735cecb15ab7aa63ecab09338f81b, f951b22dbeec46f2e0fba81cb80d1b0c686b61eb, 37eea38e7898538f0ec5f1eb8b18d8646e4be41c, a3a7e20ed66d3f04d37883c398da8a113b430769 |
| Linux/Linuxgeneric | 2.6.13 | Not reported |
| Linux/Linuxgeneric | >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <8e4422b05f410f95c51b68a0db4bf1d87f6d22f5 || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <e41d173d9dc735cecb15ab7aa63ecab09338f81b || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <f951b22dbeec46f2e0fba81cb80d1b0c686b61eb || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <37eea38e7898538f0ec5f1eb8b18d8646e4be41c || >=a257cdd0e2179630d3201c32ba14d7fcb3c3a055 <a3a7e20ed66d3f04d37883c398da8a113b430769 | 8e4422b05f410f95c51b68a0db4bf1d87f6d22f5, e41d173d9dc735cecb15ab7aa63ecab09338f81b, f951b22dbeec46f2e0fba81cb80d1b0c686b61eb, 37eea38e7898538f0ec5f1eb8b18d8646e4be41c, a3a7e20ed66d3f04d37883c398da8a113b430769 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.
Quoted source text, attributed separately from HOL analysis.