ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-89711

niche

Flawed WARN_ON_ONCE/NULL-lookup risk in Linux kernel NFSD NFS re-export path

CVSS 3.1
8.2 high
EPSS
—
Published
()
Modified
AI analysis

The Linux kernel's NFSD contained a flawed WARN_ON_ONCE in nfsd_mode_check(), added under the invalid assumption that any directory dentry passed to it supports i_op->lookup; that assumption breaks when NFSD re-exports an NFS filesystem, because dentries for NFS mountpoints and referrals (NFS_ATTR_FATTR_MOUNTPOINT / NFS_ATTR_FATTR_V4_REFERRAL) lack a lookup method. An unauthenticated remote NFS client can trigger the warning by issuing a LOOKUP into such a dentry on an affected server, causing warning spam or a panic on systems with panic_on_warn set, and without the nfserr_notdir guard the same path would NULL-dereference the i_op->lookup pointer in __lookup_slow. The fix removes the WARN_ON_ONCE while keeping the nfserr_notdir return as the actual NULL-deref protection, and CVSS 8.2 rates the impact as primarily high availability loss with minor confidentiality impact. Only servers running the kernel NFS daemon (knfsd) configured to re-export an NFS filesystem are exposed to the triggering condition. No public PoC exists, the issue is not in CISA's KEV, and no exploitation is known.

What to do: Apply your distribution's kernel update containing this fix and reboot into the patched kernel. As mitigations, avoid or unwind NFS-over-NFS re-export configurations on knfsd servers, restrict exports and firewall TCP/2049 to trusted client networks, and verify panic_on_warn is not enabled on production NFS servers so a stray warning cannot become an outage.

Affected
Linux kernel (NFSD)—
Estimated exposure
nicheunknown subset of the ~100k+ internet-exposed NFS services; likely well under 10k servers given the uncommon re-export requirement — Public internet scans typically show on the order of 100k+ devices listening on TCP/2049, but the vulnerable code path additionally requires NFSD to be re-exporting an NFS filesystem (rather than local storage), a configuration a small…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport). When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()). So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.

Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

No ingested article mentions this CVE yet.