VDB
CVE-2026-89693
CVE-2026-89693
PUBLISHED
Reported by Linux · Published September 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd4_create() stores the return value of nfsd4_acl_to_attr() in status, but the switch(create->cr_type) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL. Add an early exit check after nfsd4_acl_to_attr(), matching the pattern already used in nfsd4_setattr(). [ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]
EPSS 0.17% · 6.2th percentile
Risk Scores
EPSS Score
0.17%
6.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b, c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b, c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b |
| Linux | Linux | 6.0, 0, 6.18.51 |
| Linux | Linux | 7.3-rc1, 5.15.154, 6.0 |
| linux | linux_kernel | 6.0, 6.0, 5.10.220 |
Timeline
- Sep 11, 2026 Coalition ESS Score
- Sep 11, 2026 CVE Published
- Sep 11, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score