# CVE-2026-89695: nfsd: cap decoded POSIX ACL count to bound sort cost

> A remote attacker can cause a denial of service in the Linux kernel NFS server by sending a crafted POSIX ACL count that triggers excessive CPU usage during sorting.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-89695, GHSA-rh54-vrwc-232g, UBUNTU-CVE-2026-89695

## What is CVE-2026-89695?

CVE-2026-89695 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range(). The latter is
an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in
the server's compound processing path.

    nfsd4_decode_posixacl()
      xdr_stream_decode_u32(&count)       /* uncapped u32 */
      posix_acl_alloc(count, GFP_KERNEL)
      sort_pacl_range(*acl, 0, count - 1) /* O(n^2) bubble sort */

The encoder side in the same file already rejects ACLs whose a_count
exceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit
5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
omitted the symmetric check.

Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with
nfserr_inval, before any allocation, so the sort is bounded by
NFS_ACL_MAX_ENTRIES^2 comparisons.

While we're in here, also fix the nfserr_resource return if
posix_acl_alloc() fails. That's not a legal error code for v4.1+. Change
it to return nfserr_jukebox as that's more appropriate for memory
allocation failures.

## Which versions are affected by CVE-2026-89695?


## How do I fix CVE-2026-89695?

Apply the vendor's patch.

## Is CVE-2026-89695 being exploited?

There is no known exploitation of CVE-2026-89695 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89695 and fix it if it is affected.

What it is: CVE-2026-89695 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89695 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89695/ (Markdown: https://insights.sbomify.com/CVE-2026-89695/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89695
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89695
- OSV: https://osv.dev/vulnerability/CVE-2026-89695

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89695/
Summaries are generated and may contain mistakes; the official description above is the record.