CVE-2026-89695: nfsd: cap decoded POSIX ACL count to bound sort cost
In the Linux kernel, the following vulnerability has been resolved:
nfsd: cap decoded POSIX ACL count to bound sort cost
nfsd4decodeposixacl() reads a u32 entry count off the wire and passes it straight to posixaclalloc() and sortpaclrange(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path.
nfsd4decodeposixacl() xdrstreamdecodeu32(&count) / uncapped u32 / posixaclalloc(count, GFPKERNEL) sortpaclrange(acl, 0, count - 1) / O(n^2) bubble sort /
The encoder side in the same file already rejects ACLs whose acount exceeds NFSACLMAXENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check.
Fix by rejecting a wire count greater than NFSACLMAXENTRIES with nfserrinval, before any allocation, so the sort is bounded by NFSACLMAXENTRIES^2 comparisons.
While we're in here, also fix the nfserrresource return if posixaclalloc() fails. That's not a legal error code for v4.1+. Change it to return nfserrjukebox as that's more appropriate for memory allocation failures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/patch the kernel nfsd POSIX ACL decoder so that nfsd4_decode_posixacl() rejects (before allocation and sort) a wire-provided u32 entry count greater than NFS_ACL_MAX_ENTRIES, ensuring sort_pacl_range(*acl, 0, count - 1) (O(n^2) bubble sort) is bounded by the maximum.
Linux kernel nfsd (nfsd4_decode_posixacl) cap decoded POSIX ACL entry count to NFS_ACL_MAX_ENTRIES before sort_pacl_range() = reject if u32 decoded count exceeds NFS_ACL_MAX_ENTRIES - Configuration
In nfsd4_decode_posixacl(), if posix_acl_alloc(count, GFP_KERNEL) fails, return nfserr_jukebox (instead of nfserr_resource) so the error code is appropriate for memory allocation failures.
Linux kernel nfsd (nfsd4_decode_posixacl) nfserr_* mapping for allocation failure in posix_acl_alloc() = return nfserr_jukebox for memory allocation failures
Event History
Frequently Asked Questions
Who can trigger the excessive CPU consumption?
An NFS client that can send crafted NFSv4 compound requests containing a POSIX ACL with a client-chosen entry count can trigger it. The affected processing path is on the NFS server.
What condition makes a server vulnerable?
The server must support the POSIX draft ACL XDR decoding path introduced by commit 5fc51dfc2eb1. In the vulnerable code, decoded ACL entry counts are accepted without enforcing NFS_ACL_MAX_ENTRIES before allocation and sorting.
What is the impact of exploitation?
A maliciously large ACL count causes the server to perform an O(n^2) bubble sort in compound request processing, allowing unbounded CPU consumption. This can degrade or deny NFS server responsiveness.
How does the fix mitigate the issue?
The fix rejects wire ACL counts greater than NFS_ACL_MAX_ENTRIES with nfserr_inval before allocating or sorting the ACL. This bounds sorting work to NFS_ACL_MAX_ENTRIES squared comparisons.