{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89695 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89695 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89695 and fix it if it is affected.\n\nWhat it is: CVE-2026-89695 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89695 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89695/ (Markdown: https://insights.sbomify.com/CVE-2026-89695/index.md)","id":"CVE-2026-89695","markdown":"https://insights.sbomify.com/CVE-2026-89695/index.md","name":"CVE-2026-89695","record":{"aliases":["DEBIAN-CVE-2026-89695","GHSA-rh54-vrwc-232g","UBUNTU-CVE-2026-89695"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel NFS","requires_auth":"none","summary":"A remote attacker can cause a denial of service in the Linux kernel NFS server by sending a crafted POSIX ACL count that triggers excessive CPU usage during sorting.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: cap decoded POSIX ACL count to bound sort cost\n\nnfsd4_decode_posixacl() reads a u32 entry count off the wire and passes\nit straight to posix_acl_alloc() and sort_pacl_range(). The latter is\nan O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in\nthe server's compound processing path.\n\n    nfsd4_decode_posixacl()\n      xdr_stream_decode_u32(\u0026count)       /* uncapped u32 */\n      posix_acl_alloc(count, GFP_KERNEL)\n      sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */\n\nThe encoder side in the same file already rejects ACLs whose a_count\nexceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit\n5fc51dfc2eb1 (\"NFSD: Add support for XDR decoding POSIX draft ACLs\")\nomitted the symmetric check.\n\nFix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with\nnfserr_inval, before any allocation, so the sort is bounded by\nNFS_ACL_MAX_ENTRIES^2 comparisons.\n\nWhile we're in here, also fix the nfserr_resource return if\nposix_acl_alloc() fails. That's not a legal error code for v4.1+. Change\nit to return nfserr_jukebox as that's more appropriate for memory\nallocation failures.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nfsd: cap decoded POSIX ACL count to bound sort cost","id":"CVE-2026-89695","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref","id":"CVE-2026-89696"},"packages":[],"prev":{"headline":"nfsd: check client ownership when cancelling a copy-notify stateid","id":"CVE-2026-89694"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A remote attacker can cause a denial of service in the Linux kernel NFS server by sending a crafted POSIX ACL count that triggers excessive CPU usage during sorting.","url":"https://insights.sbomify.com/CVE-2026-89695/"}