CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved:

nfsd: gate nfs2 setacl by argp->mask

The NFSACL v2 SETACL path shares the decoder convention used by its

v3 sibling: nfsaclsvcdecodesetaclargs() fills in argp->acl_access

only when NFSACL is set in the request mask and argp->acldefault

only when NFS_DFACL is set, leaving the other pointer NULL because

the argument buffer is zeroed up to pc_argzero before decode.

nfsacldprocsetacl() then hands both pointers to setposixacl()

unconditionally. setposixacl(idmap, dentry, type, NULL) is the VFS

"remove this ACL type" operation, so an omitted arm is

indistinguishable from an explicit request to delete that ACL. A

SETACL carrying only NFS_ACL silently strips the directory's default

ACL; mask=0 strips both.

This is the same defect just fixed in nfsd3procsetacl(); apply the

same remedy. Gate each setposixacl() call on its mask bit and

initialize error to 0 so that a request with neither bit set leaves

the on-disk ACLs untouched and returns success. The outdroplock

path and the unconditional posixaclrelease() in

nfsaclsvcreleasesetacl() already tolerate the skipped arms.