CVE-2026-89695

Linux kernel nfsd is affected by a denial-of-service flaw in nfsd4_decode_posixacl(). The function reads a u32 POSIX ACL entry count off the wire without capping it and passes it to sort_pacl_range(), an O(n²) bubble sort . A malicious NFSv4 client can therefore force unbounded CPU consumption in...

PT-2026-90411

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4 decode posixacl reads a u32 entry count off the wire and passes it straight to posix acl alloc and sort pacl range. The latter is an On^2 bubble sort, so a client-chosen...