Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:53.770Z",
  "pubdate": "2026-09-11T20:19:53.770Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel nfsd implementation regarding the handling of NFSv2 SETACL requests. The issue stems from an incorrect conditional check where the system fails to verify the presence of specific ACL types in the request mask before applying changes.\nThis flaw allows a remote attacker to unintentionally or maliciously trigger the deletion of POSIX ACLs on directories. Specifically, a SETACL operation that only specifies an access ACL will inadvertently cause the target file or directory's default ACL to be stripped, or result in both ACLs being cleared if no flags are set.\nThe vulnerability affects the NFSACL v2 protocol processing logic within the kernel. The impact involves unauthorized modification of file system security attributes, potentially leading to privilege escalation or unauthorized data access by circumventing intended access control restrictions.\nExploitation requires no special authentication beyond being able to issue a SETACL request to the affected NFS export. The vulnerability is a result of logic errors in the nfsacld_proc_setacl() function, which mirrors a previously identified defect in NFSv3 handling.",
  "technicalDetails": "The root cause of this vulnerability lies in the nfsacld_proc_setacl() function within the Linux kernel's nfsd component. When an NFSv2 SETACL request is processed, the decoder function nfsaclsvc_decode_setaclargs() populates the argp->acl_access or argp->acl_default pointers only if the corresponding NFS_ACL or NFS_DFACL flags are present in the request mask. If these flags are missing, the respective pointers remain NULL.\nThe vulnerability occurs because nfsacld_proc_setacl() proceeds to pass both pointers directly to set_posix_acl() without verifying if the pointers were actually populated by the decoder. In the VFS layer, invoking set_posix_acl() with a NULL pointer is interpreted as an explicit command to remove the specified ACL type (either access or default).\nAn attacker can exploit this by crafting an NFSv2 SETACL request that includes only an access ACL. Because the code fails to gate the call to set_posix_acl() for the default ACL based on the mask, the kernel inadvertently interprets the NULL pointer as a directive to strip the default ACL from the directory. Furthermore, if a request is received with neither bit set in the mask, the current implementation attempts to process deletions for both types, effectively resetting the ACLs to a potentially insecure state.\nThe attack flow is as follows: 1) The attacker issues an NFSv2 SETACL request to the target NFS share. 2) The nfsaclsvc_decode_setaclargs() function sets the internal mask based on the request. 3) The nfsacld_proc_setacl() function receives the arguments but ignores the mask bits. 4) The function calls set_posix_acl() for both access and default ACLs. 5) If a pointer is NULL, the VFS layer performs the deletion of the corresponding ACL.\nThis behavior is critical because it equates an 'omitted' ACL in the packet with an 'explicit request to delete' at the VFS level, creating a discrepancy between the intended protocol behavior and the actual kernel execution. The vulnerability is functionally identical to the previously documented defect in nfsd3_proc_setacl(), and the impact is a loss of integrity for file system access control lists."
}