Cloudanix VulnDB

CVE-2026-89693

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux NFS server could let file-creation requests ignore requested access rules, leaving newly created files with the wrong permissions.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

nfsd4_create ignores the return value from nfsd4_acl_to_attr so ACL translation failures are dropped and the create operation continues without applying the requested ACL attributes.

Why it matters to the business

NFSv4 clients may receive files or directories whose access-control lists do not match the attributes they requested, resulting in unexpected permission grants or denials on shared storage.

How an attack unfolds

An attacker sends a crafted NFSv4 CREATE compound that includes ACL attributes the server cannot translate; because the error return is overwritten, the server silently creates the object without the ACL and returns success to the client.

How to fix it

Apply the upstream fix that adds an early exit after nfsd4_acl_to_attr in nfsd4_create, matching the pattern already present in nfsd4_setattr; rebuild and deploy the corrected kernel module or distribution package.

How to confirm the fix worked

Confirm the patched kernel source contains the early-exit check after nfsd4_acl_to_attr; recompile, boot the new kernel, and verify that CREATE operations returning ACL translation errors now fail with NFS4ERR_BADTYPE instead of succeeding without the ACL.

Typical attack path

  1. Establish an NFSv4 mount to a vulnerable server
  2. Issue a CREATE operation that supplies ACL attributes expected to trigger translation failure
  3. Observe that the object is created and no error is returned for the ACL portion
  4. Subsequent operations on the object reflect the missing or incorrect ACL

How to detect it

Search kernel logs and NFS audit trails for CREATE operations that complete successfully yet contain ACL attribute requests; compare pre- and post-patch behavior on test workloads to identify silent ACL omissions.

What your security team should do

  • Prioritize patching kernel packages that contain the nfsd module on all NFSv4 servers
  • Monitor vendor advisories for backported fixes in supported distribution kernels
  • Test the updated kernel in a staging environment before broad deployment
  • Review NFSv4 ACL usage in client applications to ensure they handle create failures gracefully

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd4_create() stores the return value of nfsd4_acl_to_attr() in status, but the switch(create->cr_type) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL. Add an early exit check after nfsd4_acl_to_attr(), matching the pattern already used in nfsd4_setattr(). [ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]

Affected packages

Ecosystem Package Introduced Fixed