CVE-2026-89671

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs3 setacl by argp->mask

nfsd3 proc setacl() calls set posix acl() unconditionally for both ACL TYPE ACCESS and ACL TYPE DEFAULT, passing argp->acl access and argp->acl default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set:

nfs3svc decode setaclargs() if (args->mask & NFS ACL) decode into acl access if (args->mask & NFS DFACL) decode into acl default /* otherwise the pointer stays NULL (pc argzero) */

nfsd3 proc setacl() set posix acl(.., ACL TYPE ACCESS, argp->acl access) set posix acl(.., ACL TYPE DEFAULT, argp->acl default)

set posix acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFS ACL silently drops the directory's default ACL; mask=0 drops both.

The sibling nfsd3 proc getacl() already consults argp->mask before touching each arm; mirror that in setacl.

Fix by wrapping each set posix acl() call in the matching mask bit check and initializing error to 0 before inode lock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfs ok. The out drop lock path and the unconditional posix acl release() at out: are preserved; both NULL-tolerate the skipped arms.