CVE-2026-89693: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89693 is an authorization bypass vulnerability in the Linux kernel's NFS server daemon (nfsd) caused by an unchecked return value in the nfsd4_create() function. When nfsd4_acl_to_attr() fails to translate an NFSv4 Access Control List, the error is silently discarded because a subsequent switch statement unconditionally overwrites the status variable in every branch, allowing file or directory creation to proceed without the requested ACL being applied. The vulnerability affects Linux kernel versions from 5.10.220 (within the 5.10.x series), 5.15.154 (within the 5.15.x series), and 6.0 and later, with fixes available in kernel 6.18.51, 7.2.4, and 7.3-rc1. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-252 (Unchecked Return Value). In nfsd4_create(), the return value of nfsd4_acl_to_attr() — which translates NFS ACL data into kernel attributes — is stored in a status variable, but the immediately following switch(create->cr_type) block unconditionally overwrites status in every branch, meaning any ACL translation error is silently lost and the CREATE operation proceeds without the intended ACL. The fix adds an early exit check after nfsd4_acl_to_attr(), mirroring the pattern already used in nfsd4_setattr(), and returns NFS4ERR_BADTYPE on failure. Exploitation requires network access and low-privilege authenticated credentials on an NFSv4 share (Red Hat Advisory, Github Advisory).

Successful exploitation allows an authenticated NFSv4 client to create files or directories on the server without the server enforcing the requested Access Control Lists, effectively bypassing intended access control restrictions on newly created objects. This results in a high integrity impact (files created with incorrect or absent ACLs), high availability impact (potential for resource manipulation), and low confidentiality impact. In environments relying on NFSv4 ACLs for data segregation or multi-tenant access control, this could enable unauthorized access to sensitive data or disruption of access control policies (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated network access (low privileges), making opportunistic mass exploitation less likely, though targeted abuse by malicious NFS clients on shared infrastructure remains a concern (Github Advisory, Red Hat Advisory).

1. Reconnaissance: Identify Linux NFS servers exposing NFSv4 shares, using tools such as nmap with NFS service detection (-sV -p 2049) or Shodan queries for NFS services.
2. Obtain authenticated access: Acquire valid NFS client credentials (e.g., a low-privileged user account) with write access to a target NFSv4 share.
3. Craft a malicious NFSv4 CREATE request: Using an NFSv4 client library or custom tooling, send a CREATE operation (for a file or directory) that includes an intentionally malformed or unsupported ACL in the fattr4 attributes, designed to trigger an error in nfsd4_acl_to_attr().
4. Trigger the silent ACL bypass: Due to the unchecked return value bug, the server discards the ACL translation error and creates the object without applying the requested ACL, resulting in the object being created with default or no ACL restrictions.
5. Access the created object: The attacker (or other clients) can now access the newly created file or directory without the access restrictions that should have been enforced, potentially reading, modifying, or deleting data that should have been protected (Red Hat Advisory, Github Advisory).

• Network: NFSv4 CREATE requests to the server containing fattr4 ACL attributes that result in no ACL being set on the created object; repeated NFSv4 CREATE operations from a single client with unusual or malformed ACL attributes.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing nfsd-related warnings or errors around ACL translation without corresponding CREATE failures; NFS audit logs showing file/directory creation events where expected ACL attributes are absent.
• File System: Newly created files or directories on NFSv4 shares with missing or default ACLs where stricter ACLs were expected; unexpected objects in restricted directories accessible to users who should not have access.

Apply the Linux kernel patches that add an early exit check after nfsd4_acl_to_attr() in nfsd4_create(). Fixed commits are available at 430ed49a16cf, 80cebb0e8a8d, and 2c7912732184 in the stable kernel tree. Patched stable releases include kernel 6.18.51 and 7.2.4; the fix is also included in 7.3-rc1. As a workaround where patching is not immediately possible, administrators should audit existing NFSv4 ACL configurations on shares and consider restricting NFS access to trusted clients only via export rules (/etc/exports) to limit exposure (Red Hat Advisory, Github Advisory).