NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89711
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:58 UTC
Updated2026-10-16 20:18:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport). When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()). So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.

Risk And Classification

Primary CVSS: v3.1 8.2 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS: 0.004040000 probability, percentile 0.339620000 (date 2026-09-14)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
3.1CNADECLARED8.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c ae251937c6f0237e5b555a5e4ba4595b8206e865 git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c e145e8d67a5d41c72d322e7f87ab474d39d9dfb7 git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c 9f4434893a2783f7384d993cea883aff3fb7a52d git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c 2ef131323999539038e306773c8256403834361b git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c b55b4d880bb080fa10eb08ba21a5d8679b8102fe git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c 7ef182a8fe9c12b0d936880b1e504840639aa009 git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c a275de3bac5635514ca830f2e46b5ff0e66b5c4c git Not specified
CNA Linux Linux affected e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e git Not specified
CNA Linux Linux affected 4.8 Not specified
CNA Linux Linux unaffected 4.8 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/9f4434893a2783f7384d993cea883aff3fb7a52d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2ef131323999539038e306773c8256403834361b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ae251937c6f0237e5b555a5e4ba4595b8206e865 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e145e8d67a5d41c72d322e7f87ab474d39d9dfb7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b55b4d880bb080fa10eb08ba21a5d8679b8102fe 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report