CVE-2026-89672
A flaw in the Linux kernel’s NFS server can let an attacker delete or modify directory access control lists without permission. The bug occurs when the server misinterprets ACL update requests, causing default ACLs to be removed silently. The issue is critical because it can compromise file permissions on any system using NFS.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server components; any system running a kernel that has not been updated to include the fix.
Real-world impact
An attacker could remove or alter directory permissions, potentially exposing sensitive files or preventing legitimate users from accessing them.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no user interaction, and can lead to complete compromise of file permissions, which is a high impact.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2026-89672.
NVD description indicates the vulnerability has been resolved.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.