{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89693", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.749Z", "datePublished": "2026-09-11T19:46:12.775Z", "dateUpdated": "2026-09-11T19:46:12.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:12.775Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()\n\nnfsd4_create() stores the return value of nfsd4_acl_to_attr() in\nstatus, but the switch(create->cr_type) block unconditionally\noverwrites it in every branch. ACL translation errors are silently\ndiscarded, and the CREATE proceeds without the requested ACL.\n\nAdd an early exit check after nfsd4_acl_to_attr(), matching the\npattern already used in nfsd4_setattr().\n\n[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "lessThan": "430ed49a16cf9ca249d0fb51490582090bc4848b", "status": "affected", "versionType": "git"}, {"version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "lessThan": "80cebb0e8a8d1e758f0d671f5e047279c5c3e528", "status": "affected", "versionType": "git"}, {"version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "lessThan": "2c7912732184773dbd371a411da87af1cc080b86", "status": "affected", "versionType": "git"}, {"version": "c5409ce523af40d5c3019717bc5b4f72038d48be", "status": "affected", "versionType": "git"}, {"version": "d52acd23a327cada5fb597591267cfc09f08bb1d", "status": "affected", "versionType": "git"}, {"version": "5.10.220", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.154", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4proc.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.220"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.154"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b"}, {"url": "https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528"}, {"url": "https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86"}], "title": "nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "430ed49a16cf9ca249d0fb51490582090bc4848b", "status": "affected", "version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "versionType": "git"}, {"lessThan": "80cebb0e8a8d1e758f0d671f5e047279c5c3e528", "status": "affected", "version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "versionType": "git"}, {"lessThan": "2c7912732184773dbd371a411da87af1cc080b86", "status": "affected", "version": "c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b", "versionType": "git"}, {"status": "affected", "version": "c5409ce523af40d5c3019717bc5b4f72038d48be", "versionType": "git"}, {"status": "affected", "version": "d52acd23a327cada5fb597591267cfc09f08bb1d", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.220", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.154", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()\n\nnfsd4_create() stores the return value of nfsd4_acl_to_attr() in\nstatus, but the switch(create->cr_type) block unconditionally\noverwrites it in every branch. ACL translation errors are silently\ndiscarded, and the CREATE proceeds without the requested ACL.\n\nAdd an early exit check after nfsd4_acl_to_attr(), matching the\npattern already used in nfsd4_setattr().\n\n[ cel: prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP ]"}], "id": "CVE-2026-89693", "lastModified": "2026-09-11T20:19:56.380", "metrics": {}, "published": "2026-09-11T20:19:56.380", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel nfsd: Access control bypass due to improper ACL error handling during file creation", "id": "2532042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532042"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-252", "details": ["A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. This vulnerability arises from improper error handling within the `nfsd4_create()` function, which is responsible for creating files and directories. When Access Control Lists (ACLs) are translated, any errors are silently discarded, allowing the creation process to proceed without applying the requested access restrictions. This could lead to an access control bypass, potentially granting unauthorized users unintended access to sensitive resources."], "name": "CVE-2026-89693", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:46:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89693\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89693\nhttps://git.kernel.org/stable/c/2c7912732184773dbd371a411da87af1cc080b86\nhttps://git.kernel.org/stable/c/430ed49a16cf9ca249d0fb51490582090bc4848b\nhttps://git.kernel.org/stable/c/80cebb0e8a8d1e758f0d671f5e047279c5c3e528"], "threat_severity": "Important"}

{"created": "2026-09-12T04:45:07.678497+00:00", "updated": "2026-09-12T04:45:07.678510+00:00", "vendors": []}