Executive brief
The Linux kernel's NFS server daemon (nfsd) contains a logic error in its file creation handler that silently discards ACL (Access Control List) configuration errors. When a client requests to create a file with specific ACL permissions, the server fails to validate that the ACL was properly applied and proceeds with file creation without the requested access controls, potentially exposing files with incorrect permissions.
Technical details
The vulnerability is a missing error-check in the nfsd4_create() function in fs/nfsd/nfs4proc.c. The function calls nfsd4_acl_to_attr() to translate NFS4 ACL attributes into POSIX ACL format and stores the return value in the status variable, but a subsequent switch statement unconditionally overwrites this status in every branch, causing ACL translation errors to be silently discarded. An attacker with NFS write permissions can request file creation with specific ACLs; if the ACL translation fails, the file is still created but without the requested ACL restrictions. The fix adds an early-exit check after nfsd4_acl_to_attr(), similar to the pattern used in nfsd4_setattr(), to return an error if ACL translation fails.
Affected products
- Linux Linux kernel multiple versions (patch backported across kernel 2.6.11 through 7.2)
Timeline
- 2026-09-11: disclosed
- 2026-08-10: patched: Upstream fix committed; backported to stable branches as of 2026-09-21