-

CVE-2026-89693

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

In the Linux kernel, the following vulnerability has been resolved:

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

nfsd4_create() stores the return value of nfsd4_acl_to_attr() in
status, but the switch(create->cr_type) block unconditionally
overwrites it in every branch. ACL translation errors are silently
discarded, and the CREATE proceeds without the requested ACL.

Add an early exit check after nfsd4_acl_to_attr(), matching the
pattern already used in nfsd4_setattr().

[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b
Version < 26877d3a09afb3838a053867a655ca30c46a1f81
Status affected
Version c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b
Version < 430ed49a16cf9ca249d0fb51490582090bc4848b
Status affected
Version c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b
Version < 80cebb0e8a8d1e758f0d671f5e047279c5c3e528
Status affected
Version c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b
Version < 2c7912732184773dbd371a411da87af1cc080b86
Status affected
Version c5409ce523af40d5c3019717bc5b4f72038d48be
Status affected
Version d52acd23a327cada5fb597591267cfc09f08bb1d
Status affected
Version 5.10.220
Version < 5.11
Status affected
Version 5.15.154
Version < 5.16
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.0
Status affected
Version 0
Version < 6.0
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b
https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528
https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86
https://git.kernel.org/stable/c/26877d3a09afb3838a053867a655ca30c46a1f81