Look up another CVE · open CVE-2026-89695 in the interactive tracker

CVE-2026-89695

nfsd: cap decoded POSIX ACL count to bound sort cost

7.5 EPSS 0.5% AV:N

Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-89695 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixacl() xdr_stream_decode_u32(&count) /* uncapped u32 */ posix_acl_alloc(count, GFP_KERNEL) sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */ The encoder side in the same file already rejects ACLs whose a_count exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs") omitted the symmetric check. Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with nfserr_inval, before any allocation, so the sort is bounded by NFS_ACL_MAX_ENTRIES^2 comparisons. While we're in here, also fix the nfserr_resource return if posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change it to return nfserr_jukebox as that's more appropriate for memory allocation failures.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/nfsd/nfs4xdr.c

What this is: KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
Kernel module: nfsd

Check it on the machine

grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w nfsd

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_NFSD, CONFIG_NFSD_V4
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-11 (37 days ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.49%, higher than 40.6% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: fs/nfsd

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
7.0	7.2.4	ea14d71d6ecb
7.0	7.3	4bc1108e8761

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: The flaw is in nfsd's NFSv4 XDR decoder (nfsd4_decode_posixacl in fs/nfsd/nfs4xdr.c), reached when a remote client sends COMPOUND SETATTR, CREATE, or OPEN with POSIX draft ACL fattrs over TCP/2049.
AC:LAttack complexity, low: The attacker supplies the u32 ACL count and reverse-sorted ACE payload on the wire; decode then runs sort_pacl_range() deterministically with no race, victim state, or memory-layout dependency.
PR:NPrivileges required, none: nfsd4_decode_posixacl() runs during COMPOUND XDR decode before SEQUENCE, filehandle, export, or setattr checks; under AUTH_SYS, the common NFS flavor, RPC credentials are attacker-asserted and no secret is verified.
UI:NUser interaction, none: nfsd worker threads decode and sort the attacker's COMPOUND automatically; no local user or administrator action is required.
S:UScope, unchanged: Impact stays inside the host kernel's nfsd thread pool; this is not a VM escape, IOMMU bypass, or other cross-authority boundary.
C:NConfidentiality impact, none: The bug only burns CPU while sorting a temporary decoded POSIX ACL; it does not read kernel or file contents, and a failed posix_acl_alloc() returns an NFS error without leaking memory.
I:NIntegrity impact, none: sort_pacl_range() only reorders the attacker's own temporary ACL buffer, which is discarded on error; no kernel memory is corrupted and no on-disk ACL is applied without later authorization.
A:HAvailability impact, high: A client-chosen ACE count, practically hundreds of thousands within the 4MiB RPC payload, drives an un-preempted O(n^2) bubble sort in an nfsd thread, stalling the finite nfsd pool so repeated requests fully deny NFS service.