CVE-2026-89711

NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

State: Published
Severity: 8.2 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport).

When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).

So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before ae251937c6f0237e5b555a5e4ba4595b8206e865Affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before e145e8d67a5d41c72d322e7f87ab474d39d9dfb7Affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 9f4434893a2783f7384d993cea883aff3fb7a52dAffected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 2ef131323999539038e306773c8256403834361bAffected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before b55b4d880bb080fa10eb08ba21a5d8679b8102feAffected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 7ef182a8fe9c12b0d936880b1e504840639aa009Affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before a275de3bac5635514ca830f2e46b5ff0e66b5c4cAffected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before aa0cf48a448c5a9fe1a1e880899ecd589ce39e6eAffected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before ae251937c6f0237e5b555a5e4ba4595b8206e865Affected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before e145e8d67a5d41c72d322e7f87ab474d39d9dfb7Affected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 9f4434893a2783f7384d993cea883aff3fb7a52dAffected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 2ef131323999539038e306773c8256403834361bAffected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before b55b4d880bb080fa10eb08ba21a5d8679b8102feAffected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 7ef182a8fe9c12b0d936880b1e504840639aa009Affected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before a275de3bac5635514ca830f2e46b5ff0e66b5c4cAffected
e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before aa0cf48a448c5a9fe1a1e880899ecd589ce39e6eAffected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.