CVE-2026-89711: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

NFSD: remove flawed WARNONONCE from nfsdmodecheck

The header for commit e75b23f9e323 ("nfsd: check dcanlookup in fhverify of directories") details the assumption that justified adding the WARNONONCE to nfsdmodecheck(), that assumption is invalid (in the case of NFS reexport).

When NFSD exports an NFS filesystem it is very possible for nfsdmodecheck() to encounter a @dentry that doesn't have iop->lookup (see nfsfhget()'s NFSATTRFATTRMOUNTPOINT and NFSATTRFATTRV4REFERRAL handling, and dflagsforinode()).

So remove nfsdmodecheck()'s WARNONONCE(). The nfserrnotdir return on that branch must stay. It guards the subsequent lookuponeunlocked() -> lookupslow() path, which calls inode->iop->lookup() with no NULL check, so returning nfserrnotdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.

Affected Software

1 affected component
Linux Kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Remove the flawed WARN_ON_ONCE from nfsd_mode_check() in NFSD (commit mentions: “NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check”).

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Which deployments are most likely to encounter this condition?

NFSD deployments that export an NFS filesystem are the relevant exposure scenario, particularly where NFS reexport can cause nfsd_mode_check() to process a dentry without an i_op->lookup method.

2

What happens when an NFS client performs a LOOKUP against the affected dentry?

The server must return nfserr_notdir for that branch. This prevents the later lookup_one_unlocked() and __lookup_slow() path from calling a NULL i_op->lookup method pointer.

3

Is the WARN_ON_ONCE itself the required protection against the NULL dereference?

No. The WARN_ON_ONCE is described as based on an invalid assumption and is removed; the nfserr_notdir return remains the protection that blocks the unsafe lookup path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203