EUVD-2026-76583
GHSA-j2pv-cprg-p57x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable NFSv3 SETACL, low complexity, but needs an authenticated client with SETACL rights (PR:L); impact is unintended ACL removal - high integrity, at most low confidentiality, no availability.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: gate nfs3 setacl by argp->mask
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and argp->acl_default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set:
nfs3svc_decode_setaclargs() if (args->mask & NFS_ACL) decode into acl_access if (args->mask & NFS_DFACL) decode into acl_default /* otherwise the pointer stays NULL (pc_argzero) */
nfsd3_proc_setacl() set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access) set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)
set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFS_ACL silently drops the directory's default ACL; mask=0 drops both.
The sibling nfsd3_proc_getacl() already consults argp->mask before touching each arm; mirror that in setacl.
Fix by wrapping each set_posix_acl() call in the matching mask bit check and initializing error to 0 before inode_lock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfs_ok. The out_drop_lock path and the unconditional posix_acl_release() at out: are preserved; both NULL-tolerate the skipped arms.
AnalysisAI
Silent ACL removal in the Linux kernel NFSv3 server (nfsd) lets a SETACL request unintentionally strip POSIX access or default ACLs from files and directories on an exported filesystem. The NFSACL SETACL handler passes the decoded acl_access/acl_default pointers to set_posix_acl() unconditionally, but the decoder leaves those pointers NULL whenever the client omits the corresponding NFS_ACL/NFS_DFACL mask bit - and a NULL pointer is the VFS signal to delete that ACL type, so a request with mask=NFS_ACL drops the directory's default ACL and mask=0 drops both. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an NFSv3 export served by the Linux in-kernel nfsd with the NFSACL sideband protocol enabled, and an NFS client permitted to mount that export and issue a SETACL operation on a target file or directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) overstates real-world risk in two ways. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Linux kernel to 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or a distribution kernel that backports commits 68a80b26/b3bff820/ff99ed00/453d7198 from git.kernel.org/stable). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Linux systems providing NFSv3 services (check /etc/exports for active exports and nfsstat for client connections) and identify those hosting sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today