Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and argp->acl_default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set: nfs3svc_decode_setaclargs() if (args->mask & NFS_ACL) decode into acl_access if (args->mask & NFS_DFACL) decode into acl_default /* otherwise the pointer stays NULL (pc_argzero) */ nfsd3_proc_setacl() set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access) set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default) set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFS_ACL silently drops the directory's default ACL; mask=0 drops both. The sibling nfsd3_proc_getacl() already consults argp->mask before touching each arm; mirror that in setacl. Fix by wrapping each set_posix_acl() call in the matching mask bit check and initializing error to 0 before inode_lock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfs_ok. The out_drop_lock path and the unconditional posix_acl_release() at out: are preserved; both NULL-tolerate the skipped arms.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:53.647Z",
  "pubdate": "2026-09-11T20:19:53.647Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the nfsd3_proc_setacl function of the Linux kernel.\nThe issue stems from the unconditional invocation of set_posix_acl for both access and default ACL types, regardless of whether the NFSv3 client intended to set or update these attributes.\nIn the VFS layer, passing a NULL pointer to set_posix_acl is interpreted as a command to remove the ACL from the inode.\nConsequently, an attacker or a legitimate client issuing a SETACL request with a partial mask (e.g., only NFS_ACL) would unintentionally trigger the removal of existing default ACLs, resulting in unauthorized data loss or privilege escalation due to modified access permissions.\nThis vulnerability impacts Linux kernel versions supporting NFSv3 ACL operations. Exploitation is trivial for any client with write access to the filesystem via NFS, as it does not require complex payloads, only carefully crafted malformed ACL control masks.",
  "technicalDetails": "The root cause of the vulnerability lies in the logic mismatch between the NFSv3 ACL decoder (nfs3svc_decode_setaclargs) and the processing function (nfsd3_proc_setacl). The decoder logic correctly checks the 'args->mask' bitfield to determine which ACLs were provided by the client, populating 'argp->acl_access' or 'argp->acl_default' only when the corresponding bit (NFS_ACL or NFS_DFACL) is set. If the bit is not set, the respective pointer remains NULL.\nThe processing function nfsd3_proc_setacl, however, fails to replicate this mask validation. It unconditionally executes 'set_posix_acl(..., ACL_TYPE_ACCESS, argp->acl_access)' and 'set_posix_acl(..., ACL_TYPE_DEFAULT, argp->acl_default)'. Within the kernel's VFS (Virtual File System) interface, calling 'set_posix_acl' with a NULL pointer is functionally equivalent to an instruction to delete the associated ACL type.\nThis creates an ambiguous state where the kernel cannot distinguish between 'the client did not send this arm' and 'the client explicitly requested to remove this ACL'. As a result, an NFSv3 client sending a SETACL request with only the NFS_ACL bit set will unintentionally trigger a 'remove' operation for the default ACL (ACL_TYPE_DEFAULT), effectively wiping it from the filesystem. If a request is sent with an empty mask, both access and default ACLs are dropped.\nExploitation involves a client initiating an NFSv3 SETACL procedure against a target directory. By manipulating the 'mask' field in the RPC call while keeping the respective ACL pointer NULL, the attacker forces the server-side 'nfsd' process to commit a permission-altering operation that the client did not explicitly request. This results in the silent deletion of ACLs, potentially exposing files to unauthorized users who previously relied on the default ACL for access restrictions. The attack requires no specialized privileges beyond the ability to perform NFS operations on the target export. The vulnerability is persistent, as the side effect (ACL deletion) is applied to the on-disk inode, permanently modifying the file system security posture until manually restored."
}