CVE-2026-89695

nfsd: cap decoded POSIX ACL count to bound sort cost

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range(). The latter is
an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in
the server's compound processing path.

nfsd4_decode_posixacl()
xdr_stream_decode_u32(&count) /* uncapped u32 */
posix_acl_alloc(count, GFP_KERNEL)
sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */

The encoder side in the same file already rejects ACLs whose a_count
exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit
5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
omitted the symmetric check.

Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with
nfserr_inval, before any allocation, so the sort is bounded by
NFS_ACL_MAX_ENTRIES^2 comparisons.

While we're in here, also fix the nfserr_resource return if
posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change
it to return nfserr_jukebox as that's more appropriate for memory
allocation failures.

Analysis

Technical impact

The Linux NFS server contains a flaw in the nfsd4_decode_posixacl routine, where a 32‑bit ACL entry count is read from the network and passed directly to the allocation and bubble‑sort functions. Because the count is not limited, a malicious client can supply an arbitrarily large number, forcing the kernel to perform an unbounded O(n²) sort that consumes excessive CPU resources. This vulnerability trigger a denial of service without authentication.

Affected Systems

Affected systems are Linux kernels that expose an NFS server and lack the bounds‑check introduced by commit 5fc51dfc2eb1. Any distribution shipping a kernel revision prior to integrating this commit is potentially vulnerable; kernels that have received the patch are considered safe.

Risk and Exploitability

The CVSS score of 7.5. The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker4 requests to the target server; by crafting a request with a very large ACL count the server will waste CPU cycles performing the bubble sort before rejecting the request with nfserr_inval. No additional privileges or authentication are required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05`	affected	< ea14d71d6ecb925673761bcf79f781f7dc9042cc
`5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05`	affected	< 4bc1108e876153a2dd6d874052b99182c3603135

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05,ea14d71d6ecb925673761bcf79f781f7dc9042cc)`	affected	code_commit	—
`[5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05,4bc1108e876153a2dd6d874052b99182c3603135)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the 5fc51dfc2eb1 bounds‑check commit or later.
Recompile the kernel without CONFIG_POSIX_ACL support to disable POSIX ACL handling on the NFS server.
As a temporary measure, configure the network to block or rate‑limit NFSv4 requests that carry unusually large ACL counts.

Generated by OpenCVE AI on September 15, 2026 at 20:38 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.488% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4bc1108e876153a2dd6d874052b99182c3603135
https://git.kernel.org/stable/c/ea14d71d6ecb925673761bcf79f781f7dc9042cc
https://nvd.nist.gov/vuln/detail/CVE-2026-89695
https://www.cve.org/CVERecord?id=CVE-2026-89695

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 12, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-400

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-606
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89695 https://www.cve.org/CVERecord?id=CVE-2026-89695
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 9:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixacl() xdr_stream_decode_u32(&count) /* uncapped u32 / posix_acl_alloc(count, GFP_KERNEL) sort_pacl_range(acl, 0, count - 1) /* O(n^2) bubble sort */ The encoder side in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check. Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval, before any allocation, so the sort is bounded by NFS_ACL_MAX_ENTRIES^2 comparisons. While we're in here, also fix the nfserr_resource return if posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change it to return nfserr_jukebox as that's more appropriate for memory allocation failures.
Title		nfsd: cap decoded POSIX ACL count to bound sort cost
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4bc1108e876153a2dd6d874052b99182c3603135 https://git.kernel.org/stable/c/ea14d71d6ecb925673761bcf79f781f7dc9042cc