CVE-2020-24394: In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new fi...

Security readout for executives and security teams

CVE-2020-24394 is a Linux kernel NFS server flaw where newly created files or directories could receive permissions that are broader than intended. The issue applies before Linux 5.7.8 when the exported filesystem lacks ACL support, because the server did not account for the current umask. Exposure is most likely on Linux systems acting as NFS servers, running vulnerable kernels, and exporting filesystems without ACL support. Systems not providing NFS service, already patched by vendor kernels, or using unaffected filesystem paths are less likely to be exposed. Treat this as a moderate-priority infrastructure hygiene issue. Prioritize shared storage servers and environments handling sensitive files, because incorrect default permissions can undermine access-control expectations without a dramatic exploit chain. Mitigation focus: Update affected Linux kernels using vendor security advisories or kernel 5.7.8 or later.; Confirm downstream vendor kernels include commit 22cf8419f131 or an equivalent backport.; Prioritize NFS servers exporting filesystems that lack ACL support..

Prepared

Jun 3, 2026, 10:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.