Threats tagged 'ghsa-69qx-3mcm-9wpc'

A vulnerability in the Linux kernel's NFS server (NFSD) causes NFSv4 file creation to neglect setting the requested POSIX ACL. When an NFSv4 client sets an ACL with a named principal during file creation, the ACL returned afterwards is a default one derived from mode bits rather than the originally specified ACL. This behavior violates RFC 8881 section 6.4.1.3, which requires the ACL attribute to be set as given. The issue stems from the nfsd_create_setattr() function skipping the application of POSIX ACLs due to incomplete checks in nfsd_attrs_valid().