CVE-2026-89711

Received Received - Intake

WARN_ON_ONCE Removal in Linux Kernel NFSD

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport). When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()). So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89711

EUVD

EUVD-2026-76623

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the NFS server (NFSD) where a flawed warning check in nfsd_mode_check() could trigger incorrectly during NFS reexport scenarios. The issue arises because nfsd_mode_check() may encounter directory entries without a lookup operation, which violates an assumption that justified the warning. The fix removes this warning while keeping the error handling intact to prevent NULL pointer dereferences.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and does not have a direct detection method via network commands. It requires checking the kernel version and NFS server configuration for the flawed WARN_ON_ONCE in nfsd_mode_check(). Use 'uname -a' to check the kernel version and 'cat /proc/fs/nfsd/versions' to verify NFS server status.

Impact Analysis

This vulnerability could cause unexpected warnings or crashes in systems running NFS servers that reexport NFS filesystems. It may lead to instability or denial of service if the flawed warning triggers in production environments, though the primary risk is from the incorrect assumption rather than direct exploitation.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel security advisories for the fix and apply updates via your distribution's package manager (e.g., 'apt upgrade' or 'yum update'). Ensure NFS exports are reviewed for potential misconfigurations.

Hi! I’m here to help you understand CVE-2026-89711. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70