CVE-2026-89671

CVE-2026-89671 affects the Linux kernel NFS daemon (nfsd ). The function nfsd3_proc_setacl() unconditionally calls set_posix_acl() for both access and default ACL types, even when the NFSv3 client did not send those fields (pointer is NULL). In VFS, set_posix_acl(…, NULL) means remove this ACL , ...