CVE-2026-89695: nfsd: cap decoded POSIX ACL count to bound sort cost
In the Linux kernel, the following vulnerability has been resolved:
nfsd: cap decoded POSIX ACL count to bound sort cost
nfsd4decodeposixacl() reads a u32 entry count off the wire and passes it straight to posixaclalloc() and sortpaclrange(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path.
nfsd4decodeposixacl() xdrstreamdecodeu32(&count) / uncapped u32 / posixaclalloc(count, GFPKERNEL) sortpaclrange(acl, 0, count - 1) / O(n^2) bubble sort /
The encoder side in the same file already rejects ACLs whose acount exceeds NFSACLMAXENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check.
Fix by rejecting a wire count greater than NFSACLMAXENTRIES with nfserrinval, before any allocation, so the sort is bounded by NFSACLMAXENTRIES^2 comparisons.
While we're in here, also fix the nfserrresource return if posixaclalloc() fails. That's not a legal error code for v4.1+. Change it to return nfserrjukebox as that's more appropriate for memory allocation failures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In nfsd4_decode_posixacl(), reject a wire ACL entry count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval before any allocation, and return nfserr_jukebox when posix_acl_alloc() fails.
Event History
Frequently Asked Questions
Who can trigger the excessive CPU consumption?
An NFS client that can send crafted NFSv4 compound requests containing a POSIX ACL with a client-chosen entry count can trigger it. The affected processing path is on the NFS server.
What condition makes a server vulnerable?
The server must support the POSIX draft ACL XDR decoding path introduced by commit 5fc51dfc2eb1. In the vulnerable code, decoded ACL entry counts are accepted without enforcing NFS_ACL_MAX_ENTRIES before allocation and sorting.
What is the impact of exploitation?
A maliciously large ACL count causes the server to perform an O(n^2) bubble sort in compound request processing, allowing unbounded CPU consumption. This can degrade or deny NFS server responsiveness.
How does the fix mitigate the issue?
The fix rejects wire ACL counts greater than NFS_ACL_MAX_ENTRIES with nfserr_inval before allocating or sorting the ACL. This bounds sorting work to NFS_ACL_MAX_ENTRIES squared comparisons.