CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc decode setaclargs() fills in argp->acl access only when NFS ACL is set in the request mask and argp->acl default only when NFS DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc argzero before decode.

nfsacld proc setacl() then hands both pointers to set posix acl() unconditionally. set posix acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS ACL silently strips the directory's default ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3 proc setacl(); apply the same remedy. Gate each set posix acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out drop lock path and the unconditional posix acl release() in nfsaclsvc release setacl() already tolerate the skipped arms.