CVE-2026-89693

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

nfsd4_create() stores the return value of nfsd4_acl_to_attr() in status, but the switch(create->cr_type) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL.

Add an early exit check after nfsd4_acl_to_attr(), matching the pattern already used in nfsd4_setattr().

[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c5409ce523af40d5c3019717bc5b4f72038d48be to before 154acf97ecd2c0bb00f6533f86d4bd2b934475d5Affected d52acd23a327cada5fb597591267cfc09f08bb1d to before 73dfa989f6f0dedcae1f2650aab3401537044282Affected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 04b913ab96c2a874f41b5e5a19ac7120526723c2Affected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 2d8a8ed4f9d8637ef0f18d47d19193e7b780e90eAffected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 26877d3a09afb3838a053867a655ca30c46a1f81Affected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 430ed49a16cf9ca249d0fb51490582090bc4848bAffected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 80cebb0e8a8d1e758f0d671f5e047279c5c3e528Affected c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 2c7912732184773dbd371a411da87af1cc080b86Affected 5.10.220 to before 5.10.273Affected 5.15.154 to before 5.15.224Affected
LinuxLinux	6.0Affected before 6.0Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c5409ce523af40d5c3019717bc5b4f72038d48be to before 154acf97ecd2c0bb00f6533f86d4bd2b934475d5Affected
d52acd23a327cada5fb597591267cfc09f08bb1d to before 73dfa989f6f0dedcae1f2650aab3401537044282Affected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 04b913ab96c2a874f41b5e5a19ac7120526723c2Affected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 2d8a8ed4f9d8637ef0f18d47d19193e7b780e90eAffected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 26877d3a09afb3838a053867a655ca30c46a1f81Affected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 430ed49a16cf9ca249d0fb51490582090bc4848bAffected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 80cebb0e8a8d1e758f0d671f5e047279c5c3e528Affected
c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b to before 2c7912732184773dbd371a411da87af1cc080b86Affected
5.10.220 to before 5.10.273Affected
5.15.154 to before 5.15.224Affected

LinuxLinux

6.0Affected
before 6.0Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.