In the Linux kernel's NFSv3 server code, the function nfsd3_proc_setacl() calls set_posix_acl() for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT without checking if the client actually provided those ACLs. The NFSv3 ACL decoder sets pointers to ACL data only if the corresponding mask bits (NFS_ACL or NFS_DFACL) are set; otherwise, these pointers remain NULL. Since set_posix_acl() interprets a NULL pointer as a request to remove that ACL type, a client request with mask=NFS_ACL unintentionally removes the directory's default ACL, and a request with mask=0 removes both ACLs. The vulnerability is fixed by adding checks for the mask bits before calling set_posix_acl(), ensuring ACLs are only modified when explicitly requested.

This vulnerability can cause unintended removal of ACLs on directories when clients send SETACL requests with certain mask values. Specifically, a SETACL request with mask=NFS_ACL silently drops the default ACL, and a request with mask=0 drops both access and default ACLs. This could lead to loss of intended access controls on files or directories, potentially affecting system security and access permissions.

A fix has been implemented in the Linux kernel that adds mask bit checks before calling set_posix_acl() in nfsd3_proc_setacl(), preventing unintended ACL removals. Users should apply the official kernel update that includes this fix. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the input; users should consult the vendor or Linux kernel advisory for the exact fixed versions and apply updates accordingly.