Executive brief
The Linux kernel's NFS server (nfsd) has a logic error in handling NFSv3 ACL (Access Control List) operations that can cause unintended removal of file permissions. When a client sends a SETACL request, the server may silently delete directory default ACLs or both access and default ACLs even when the client did not request their removal. This could lead to files becoming accessible to unauthorized users or breaking intended permission structures on NFS-exported filesystems.
Technical details
The vulnerability exists in nfsd3_proc_setacl() in fs/nfsd/nfs3acl.c. The function unconditionally calls set_posix_acl() for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing pointers that may be NULL. The NFSv3 decoder only populates these pointers when the corresponding mask bit (NFS_ACL or NFS_DFACL) is set; otherwise they remain NULL. Since set_posix_acl() with a NULL pointer is the VFS operation to remove an ACL type, NULL pointers that should mean "client did not send this" are indistinguishable from "client requested removal". A SETACL with mask=NFS_ACL silently drops the default ACL; mask=0 drops both. The fix gates each set_posix_acl() call behind the matching mask bit check, mirroring the logic already present in nfsd3_proc_getacl(). No authentication or special privileges are required; any NFSv3 client can trigger this by crafting requests with mismatched mask values.
Affected products
- Linux Linux kernel all versions containing the nfsd NFSv3 ACL implementation; fixed in commits 453d7198a0ab07a12d46e0575861ac7b932da17e and later
Timeline
- 2026-09-11: disclosed
- 2026-08-10: patched: upstream commit 453d7198a0ab07a12d46e0575861ac7b932da17e merged by Chuck Lever
- 2026-05-30: other: initial fix reported by Chris Mason