Executive brief
The Linux kernel's NFS server component (nfsd) processes ACL (access control list) data received from network clients. A flaw in the POSIX ACL decoder allowed clients to send unbounded ACL entry counts, triggering an O(n²) sorting algorithm on the server and consuming arbitrary CPU resources. An attacker could exploit this to cause denial of service on NFS servers, degrading performance or making them unresponsive.
Technical details
The vulnerability is a denial-of-service condition in the nfsd4_decode_posixacl() function. The decoder reads an unchecked u32 count value from the network wire and passes it directly to posix_acl_alloc() and sort_pacl_range(), where the latter performs an O(n²) bubble sort. An unauthenticated network attacker can send a crafted NFS request with an arbitrarily large POSIX ACL count to trigger unbounded CPU consumption on the server's NFS compound processing path. The encoder side already enforced a cap (NFS_ACL_MAX_ENTRIES), but the decoder lacked this validation. The fix adds a count check before allocation and memory sorting, bounding server CPU usage. Additionally, an incorrect error code (nfserr_resource) was replaced with nfserr_jukebox for memory allocation failures.
Affected products
- Linux Linux kernel Versions from commit 5fc51dfc2eb1 onwards (POSIX ACL NFSv4 support introduction) through patches included in stable branches (2.6.11.y through 7.2.y)
Timeline
- 2026-09-11: disclosed: CVE-2026-89695 published on NVD
- 2026-08-10: patched: Fix committed upstream by Chuck Lever on 2026-08-10
- 2026-09-07: patched: Fix backported to stable kernels by Greg Kroah-Hartman on 2026-09-07