CVE-2026-89695

Received Received - Intake

Denial of Service in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixacl() xdr_stream_decode_u32(&count) /* uncapped u32 */ posix_acl_alloc(count, GFP_KERNEL) sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */ The encoder side in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check. Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval, before any allocation, so the sort is bounded by NFS_ACL_MAX_ENTRIES^2 comparisons. While we're in here, also fix the nfserr_resource return if posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change it to return nfserr_jukebox as that's more appropriate for memory allocation failures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89695

EUVD

EUVD-2026-76607

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of POSIX ACL (Access Control List) counts in the NFS server. A client can send a large ACL count value that bypasses validation, causing the server to perform an unbounded O(n^2) bubble sort operation. This leads to excessive CPU usage and potential denial of service.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation. Detection requires checking if your system is running a vulnerable kernel version. Examine kernel logs for NFS-related errors or unusual CPU spikes during NFS operations. Use commands like 'uname -a' to check kernel version and 'dmesg | grep nfsd' to inspect NFS server logs.

Impact Analysis

An attacker could exploit this to consume excessive server CPU resources by sending specially crafted NFS requests, potentially causing system slowdowns or crashes. Systems relying on NFS for file sharing are most at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through excessive CPU consumption. Unbounded CPU usage in NFS server processing could disrupt availability of critical systems handling sensitive data, violating requirements for timely access and system resilience in both GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)).

Mitigation Strategies

Apply the latest kernel security patches to update to a fixed version. If patching is not immediately possible, disable NFSv4.1+ ACL support or restrict access to NFS services. Monitor system performance for abnormal CPU usage during NFS operations.

Hi! I’m here to help you understand CVE-2026-89695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70