DEBIAN-CVE-2026-89671

In the Linux kernel, the following vulnerability has been resolved:  nfsd: gate nfs3 setacl by argp->mask  nfsd3procsetacl() calls setposixacl() unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp->aclaccess and argp->acldefault verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set:      nfs3svcdecodesetaclargs()       if (args->mask & NFSACL)    decode into aclaccess       if (args->mask & NFSDFACL)  decode into acldefault       /* otherwise the pointer stays NULL (pcargzero) */      nfsd3procsetacl()       setposixacl(.., ACLTYPEACCESS,  argp->aclaccess)       setposixacl(.., ACLTYPEDEFAULT, argp->acldefault)  setposixacl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFSACL silently drops the directory's default ACL; mask=0 drops both.  The sibling nfsd3procgetacl() already consults argp->mask before touching each arm; mirror that in setacl.  Fix by wrapping each setposixacl() call in the matching mask bit check and initializing error to 0 before inodelock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfsok. The outdroplock path and the unconditional posixaclrelease() at out: are preserved; both NULL-tolerate the skipped arms.