A critical vulnerability in the Linux kernel NFS implementation allows unauthenticated remote attackers to modify or delete file system access control lists, potentially leading to unauthorized data exposure or access.

The vulnerability exists in the nfsacld_proc_setacl function, where the kernel incorrectly interprets missing ACL bits in a SETACL request as an explicit command to remove those ACLs. Because this function performs these operations without verifying the request mask, an unauthenticated remote attacker can trigger the removal of default directory ACLs.

The ability to manipulate or remove access control lists on a server can result in the unauthorized exposure of sensitive files or the unintended alteration of security permissions. Given the CVSS score of 9.1, this vulnerability poses a severe risk to data confidentiality and integrity, as it allows attackers to bypass intended access restrictions and potentially gain broader access to the underlying storage system.

Immediate Action: Administrators must update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by their distribution vendor.

Proactive Monitoring: Security teams should monitor NFS traffic for unexpected SETACL operations and review system logs for modifications to directory permissions that do not align with authorized administrative activity.

Compensating Controls: If patching is not immediately feasible, restrict network access to the NFS service to trusted IP ranges using host-based firewalls or network access control lists to prevent unauthorized remote requests.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the security of networked storage environments. Given the critical severity rating and the potential for unauthorized privilege escalation via ACL manipulation, organizations should prioritize the deployment of the provided kernel patches across all affected infrastructure to eliminate the exposure window.