UBUNTU-CVE-2026-89671: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3procsetacl() calls setposixacl() unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp->aclaccess and argp->acldefault verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set: nfs3svcdecodesetaclargs() if (args->mask & NFSACL) decode into aclaccess if (args->mask & NFSDFACL) decode into acldefault / otherwise the pointer stays NULL (pcargzero) / nfsd3procsetacl() setposixacl(.., ACLTYPEACCESS, argp->aclaccess) setposixacl(.., ACLTYPEDEFAULT, argp->acldefault) setposixacl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFSACL silently drops the directory's default ACL; mask=0 drops both. The sibling nfsd3procgetacl() already consults argp->mask before touching each arm; mirror that in setacl. Fix by wrapping each setposixacl() call in the matching mask bit check and initializing error to 0 before inodelock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfsok. The outdroplock path and the unconditional posixaclrelease() at out: are preserved; both NULL-tolerate the skipped arms.