In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl()… (CVE-2026-89695)
A vulnerability in the Linux kernel's NFS server (nfsd) was resolved that involved unbounded CPU usage due to an uncapped POSIX ACL entry count. The function nfsd4_decode_posixacl() reads an unchecked 32-bit count from the network and passes it to posix_acl_alloc() and an O(n^2) bubble sort, allowing a client to cause excessive CPU consumption. The fix adds a check to reject counts exceeding NFS_ACL_MAX_ENTRIES before allocation and sorting, bounding the CPU cost. Additionally, the error code returned on memory allocation failure was corrected.
AI Analysis
Technical Summary
The Linux kernel's nfsd4_decode_posixacl() function previously accepted an uncapped 32-bit POSIX ACL entry count from the network, which it passed directly to posix_acl_alloc() and sort_pacl_range(). The latter performs an O(n^2) bubble sort, so a large client-chosen count could cause unbounded CPU usage during NFS compound processing. Although the encoder side limits ACL counts to NFS_ACL_MAX_ENTRIES, the decoder omitted this check. The vulnerability was fixed by rejecting wire counts greater than NFS_ACL_MAX_ENTRIES with an nfserr_inval error before any allocation, bounding the sorting cost. The fix also corrected the error code returned on allocation failure to nfserr_jukebox, which is appropriate for memory failures in NFSv4.1+.
Potential Impact
An attacker controlling NFS client input could send a POSIX ACL with an excessively large entry count, causing the NFS server to perform an unbounded amount of CPU work due to an O(n^2) bubble sort. This can lead to denial of service by exhausting server CPU resources during NFS compound request processing.
Mitigation Recommendations
A fix is available that adds a check to reject POSIX ACL counts exceeding NFS_ACL_MAX_ENTRIES before allocation and sorting, bounding CPU usage. Systems should apply the official patch to the Linux kernel to prevent this unbounded CPU consumption vulnerability. No other mitigations are indicated.
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl()… (CVE-2026-89695)
Description
A vulnerability in the Linux kernel's NFS server (nfsd) was resolved that involved unbounded CPU usage due to an uncapped POSIX ACL entry count. The function nfsd4_decode_posixacl() reads an unchecked 32-bit count from the network and passes it to posix_acl_alloc() and an O(n^2) bubble sort, allowing a client to cause excessive CPU consumption. The fix adds a check to reject counts exceeding NFS_ACL_MAX_ENTRIES before allocation and sorting, bounding the CPU cost. Additionally, the error code returned on memory allocation failure was corrected.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's nfsd4_decode_posixacl() function previously accepted an uncapped 32-bit POSIX ACL entry count from the network, which it passed directly to posix_acl_alloc() and sort_pacl_range(). The latter performs an O(n^2) bubble sort, so a large client-chosen count could cause unbounded CPU usage during NFS compound processing. Although the encoder side limits ACL counts to NFS_ACL_MAX_ENTRIES, the decoder omitted this check. The vulnerability was fixed by rejecting wire counts greater than NFS_ACL_MAX_ENTRIES with an nfserr_inval error before any allocation, bounding the sorting cost. The fix also corrected the error code returned on allocation failure to nfserr_jukebox, which is appropriate for memory failures in NFSv4.1+.
Potential Impact
An attacker controlling NFS client input could send a POSIX ACL with an excessively large entry count, causing the NFS server to perform an unbounded amount of CPU work due to an O(n^2) bubble sort. This can lead to denial of service by exhausting server CPU resources during NFS compound request processing.
Mitigation Recommendations
A fix is available that adds a check to reject POSIX ACL counts exceeding NFS_ACL_MAX_ENTRIES before allocation and sorting, bounding CPU usage. Systems should apply the official patch to the Linux kernel to prevent this unbounded CPU consumption vulnerability. No other mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rh54-vrwc-232g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89695"]
Threat ID: 6aa49ffc55bf5e2cf5a865e1
Added to database: 09/12/2026, 00:42:36 UTC
Last enriched: 09/12/2026, 00:51:32 UTC
Last updated: 09/12/2026, 00:51:32 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.