DEBIAN-CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved:  nfsd: gate nfs2 setacl by argp->mask  The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs() fills in argp->aclaccess only when NFSACL is set in the request mask and argp->acldefault only when NFSDFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pcargzero before decode.  nfsacldprocsetacl() then hands both pointers to setposixacl() unconditionally. setposixacl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFSACL silently strips the directory's default ACL; mask=0 strips both.  This is the same defect just fixed in nfsd3procsetacl(); apply the same remedy. Gate each setposixacl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The outdroplock path and the unconditional posixaclrelease() in nfsaclsvcreleasesetacl() already tolerate the skipped arms.