nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
Published Sep 11, 2026
7.0
HIGHCVSS 3.1
EPSS 0.17%
Description
nfsd4_create() stores the return value of nfsd4_acl_to_attr() in status, but the switch(create->cr_type) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL.
Add an early exit check after nfsd4_acl_to_attr(), matching the pattern already used in nfsd4_setattr().
[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]
Affected products
-
- Version 5.10.220StatusaffectedConstraints<5.11
- Version 5.15.154StatusaffectedConstraints<5.16
- Version
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints-
- Version StatusaffectedConstraints-
- Version
-
- Version 6.0StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<6.0
- Version 6.12.111StatusunaffectedConstraints<=6.12.*
- Version 6.18.51StatusunaffectedConstraints<=6.18.*
- Version 7.2.4StatusunaffectedConstraints<=7.2.*
- Version 7.3-rc1StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| |||||||||||||||||||||
| Linux | Linux | unaffected |
| |||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
Red Hat Enterprise Linux 10
kernel
Affected
Red Hat Enterprise Linux 10
kernel-rt
Affected
Red Hat Enterprise Linux 6
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Affected
Red Hat Enterprise Linux 9
kernel-rt
Affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-9
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 10 | kernel-rt | Affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (10)
- https://access.redhat.com/security/cve/CVE-2026-89693 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2532042 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76605 Advisory
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89693.mbox
- https://git.kernel.org/stable/c/26877d3a09afb3838a053867a655ca30c46a1f81
- https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86
- https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b
- https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528
- https://nvd.nist.gov/vuln/detail/CVE-2026-89693
- https://www.cve.org/CVERecord?id=CVE-2026-89693
Change history (0)
No recorded changes yet.