PT-2026-90409 · Linux · Linux
CVE-2026-89693
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check nfsd4 acl to attr() return value in nfsd4 create()
nfsd4 create() stores the return value of nfsd4 acl to attr() in
status, but the switch(create->cr type) block unconditionally
overwrites it in every branch. ACL translation errors are silently
discarded, and the CREATE proceeds without the requested ACL.
Add an early exit check after nfsd4 acl to attr(), matching the
pattern already used in nfsd4 setattr().
[ cel: prefer NFS4ERR BADTYPE over NFS4ERR ATTRNOTSUPP ]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux