CVE-2026-89693

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the nfsd component, the nfsd4 create() function fails to properly handle the return value of the nfsd4 acl to attr() function. The return value is stored in the status variable, but a subsequent switch(create->cr type) block unconditionally overwrites this value in every branch. Consequently, Access Control List (ACL) translation errors are silently discarded, allowing the CREATE operation to proceed without the requested ACL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.