CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask

CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs3 setacl by argp->mask

nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and
argp->acl_default verbatim. The NFSv3 ACL decoder only populates
those pointers when the corresponding mask bit is set:

    nfs3svc_decode_setaclargs()
      if (args->mask & NFS_ACL)    decode into acl_access
      if (args->mask & NFS_DFACL)  decode into acl_default
      /* otherwise the pointer stays NULL (pc_argzero) */

    nfsd3_proc_setacl()
      set_posix_acl(.., ACL_TYPE_ACCESS,  argp->acl_access)
      set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)

set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this
ACL type" operation. A NULL pointer that means "the client did not
send this arm" is therefore indistinguishable from "the client
asked to remove this ACL". A SETACL with mask=NFS_ACL silently
drops the directory's default ACL; mask=0 drops both.

The sibling nfsd3_proc_getacl() already consults argp->mask before
touching each arm; mirror that in setacl.

Fix by wrapping each set_posix_acl() call in the matching mask bit
check and initializing error to 0 before inode_lock so that a
request with neither bit set leaves the on-disk ACLs untouched and
returns nfs_ok. The out_drop_lock path and the unconditional
posix_acl_release() at out: are preserved; both NULL-tolerate the
skipped arms.

The Linux kernel CVE team has assigned CVE-2026-89671 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.13 with commit a257cdd0e2179630d3201c32ba14d7fcb3c3a055 and fixed in 6.12.109 with commit 68a80b26efdff1d09f8ae1773c6a915abb9e191d
	Issue introduced in 2.6.13 with commit a257cdd0e2179630d3201c32ba14d7fcb3c3a055 and fixed in 6.18.50 with commit b3bff820d068ea59767d4e91a3258231a879da5f
	Issue introduced in 2.6.13 with commit a257cdd0e2179630d3201c32ba14d7fcb3c3a055 and fixed in 7.2.4 with commit ff99ed007f065198fd723152405c22aa558f700b
	Issue introduced in 2.6.13 with commit a257cdd0e2179630d3201c32ba14d7fcb3c3a055 and fixed in 7.3-rc1 with commit 453d7198a0ab07a12d46e0575861ac7b932da17e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89671
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfsd/nfs3acl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d
	https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f
	https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b
	https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e