UBUNTU-CVE-2026-89672: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs() fills in argp->aclaccess only when NFSACL is set in the request mask and argp->acldefault only when NFSDFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pcargzero before decode. nfsacldprocsetacl() then hands both pointers to setposixacl() unconditionally. setposixacl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFSACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3procsetacl(); apply the same remedy. Gate each setposixacl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The outdroplock path and the unconditional posixaclrelease() in nfsaclsvcreleasesetacl() already tolerate the skipped arms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In nfsacld_proc_setacl(), initialize the error to 0 and gate each set_posix_acl() call on its corresponding request-mask bit: call it for the access ACL only when NFS_ACL is set and for the default ACL only when NFS_DFACL is set, so omitted ACL arms remain untouched and a request with neither bit succeeds.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs NFSACL v2 SETACL access with low-level privileges sufficient to issue a SETACL request against an exported directory. The issue affects systems using the listed Ubuntu kernel packages where NFSACL v2 SETACL requests are processed.
What is the impact of a crafted SETACL request?
A request containing only the NFS_ACL mask bit can remove a directory's default ACL, while a request with a zero mask can remove both ACL types. This can alter filesystem access-control settings without explicitly requesting deletion of the omitted ACL type.
How can I tell whether a system may have been affected?
Review NFSACL v2 SETACL activity and inspect directories served through NFS for missing access or default POSIX ACLs. In particular, investigate directories where ACLs disappeared after SETACL requests that specified only one ACL mask bit or no mask bits.
What mitigation is available if patching cannot happen immediately?
Limit or disable NFSACL v2 SETACL operations for untrusted or unnecessary clients, and restrict access to NFS exports to trusted principals. Monitor and restore directory ACLs where unauthorized or unexpected changes are found.