A critical vulnerability in the Linux kernel NFS daemon allows unauthenticated remote attackers to silently delete file system access control lists.

The nfsd3_proc_setacl function incorrectly handles NULL pointers for ACL types, making them indistinguishable from explicit requests to remove ACLs. An unauthenticated attacker can trigger this via a crafted NFSv3 SETACL request, causing the kernel to inadvertently drop directory permissions.

Successful exploitation results in the unauthorized modification of file system security configurations, specifically the deletion of access control lists. This leads to privilege escalation or the exposure of sensitive data by removing restrictive access policies. Given the CVSS score of 9.1, this flaw poses a severe risk to data integrity and system security, potentially impacting all environments utilizing NFSv3 exports.

Immediate Action: Upgrade the Linux kernel to version 6.6.157, 6.12.109, 6.18.50, or 7.2.4 as appropriate for your distribution.

Proactive Monitoring: Monitor NFS server logs for unusual SETACL activity or unexpected changes to file system permissions and ownership.

Compensating Controls: If patching is not immediately feasible, restrict access to the NFS service to trusted network segments only to prevent interaction from unauthorized clients.

Public Exploit Available: No

This vulnerability represents a significant risk to the security posture of any Linux-based NFS server, as it allows for the silent destruction of access control policies without requiring authentication. Administrators must prioritize updating the kernel to the provided fixed versions to prevent potential unauthorized data access or privilege escalation. Failure to patch leaves critical file systems vulnerable to remote permission manipulation.