CVE-2026-89672High· 7.0▾ TwilightA flaw was found in the Linux kernel's Network File System (NFS) server daemon (`nfsd`). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both acce…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 6.8
none → medium
0.2% → 0.5%
— → 6.8
none → medium
— → 9.1
none → critical
9.1 → 6.8
critical → medium
6.8 → 9.1
medium → critical
Last analysed / modified upstream
9.1 → 7
critical → high
A flaw was found in the Linux kernel's Network File System (NFS) server daemon (nfsd). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both access and default ACLs. This occurs because the set_posix_acl() function is called unconditionally, even if the request mask indicates that no ACLs should be set, leading to an unintended removal operation. This could allow an attacker to modify file system permissions without authorization.
kernel: nfsd: gate nfs2 setacl by argp->mask — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-16.
Affected:
No fix planned:
Not affected:
Affected
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80936Medium· 5.5kernel: wifi: mt76: mt7925: cancel mlo_pm_work on stop (CVE-2026-80936)
CVE-2026-80947High· 7.0kernel: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (CVE-2026-80947)
CVE-2026-80980Medium· 5.5kernel: net/smc: stop killed, freed and out_of_sync sharing a byte (CVE-2026-80980)
CVE-2026-80981High· 7.0kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)
CVE-2026-80985High· 7.0kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
CVE-2026-80986High· 7.0kernel: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (CVE-2026-80986)