{"id":"CVE-2026-89711","title":"NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check\n\nThe header for commit e75b23f9e323 (\"nfsd: check d_can_lookup in\nfh_verify of directories\") details the assumptio…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < ae251937c6f0237e5b555a5e4ba4595b8206e865","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < e145e8d67a5d41c72d322e7f87ab474d39d9dfb7","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 9f4434893a2783f7384d993cea883aff3fb7a52d","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 2ef131323999539038e306773c8256403834361b","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < b55b4d880bb080fa10eb08ba21a5d8679b8102fe","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 7ef182a8fe9c12b0d936880b1e504840639aa009","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < a275de3bac5635514ca830f2e46b5ff0e66b5c4c","Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e","Linux 4.8"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T12:02:10.683Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89711","references":[{"url":"https://git.kernel.org/stable/c/ae251937c6f0237e5b555a5e4ba4595b8206e865"},{"url":"https://git.kernel.org/stable/c/e145e8d67a5d41c72d322e7f87ab474d39d9dfb7"},{"url":"https://git.kernel.org/stable/c/9f4434893a2783f7384d993cea883aff3fb7a52d"},{"url":"https://git.kernel.org/stable/c/2ef131323999539038e306773c8256403834361b"},{"url":"https://git.kernel.org/stable/c/b55b4d880bb080fa10eb08ba21a5d8679b8102fe"},{"url":"https://git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009"},{"url":"https://git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c"},{"url":"https://git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e"}],"tags":["cve.org"],"epss":0.00449,"epssPercentile":0.38405,"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89711","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check\n\nThe header for commit e75b23f9e323 (\"nfsd: check d_can_lookup in\nfh_verify of directories\") details the assumption that justified\nadding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is\ninvalid (in the case of NFS reexport).\n\nWhen NFSD exports an NFS filesystem it is very possible for\nnfsd_mode_check() to encounter a @dentry that doesn't have\ni_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and\nNFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).\n\nSo remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir\nreturn on that branch must stay. It guards the subsequent\nlookup_one_unlocked() -> __lookup_slow() path, which calls\ninode->i_op->lookup() with no NULL check, so returning nfserr_notdir\nis what keeps a client LOOKUP into such a @dentry from dereferencing\na NULL method pointer.\n\n## Affected\n\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < ae251937c6f0237e5b555a5e4ba4595b8206e865`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < e145e8d67a5d41c72d322e7f87ab474d39d9dfb7`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 9f4434893a2783f7384d993cea883aff3fb7a52d`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 2ef131323999539038e306773c8256403834361b`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < b55b4d880bb080fa10eb08ba21a5d8679b8102fe`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < 7ef182a8fe9c12b0d936880b1e504840639aa009`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < a275de3bac5635514ca830f2e46b5ff0e66b5c4c`\n- `Linux >= e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c < aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e`\n- `Linux 4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":197702,"id":"CVE-2026-89711","ts":1789384318472,"field":"cvss","old":"5.9","new":"8.2"},{"seq":197701,"id":"CVE-2026-89711","ts":1789384318472,"field":"severity","old":"medium","new":"high"},{"seq":183349,"id":"CVE-2026-89711","ts":1789356674992,"field":"cvss","old":"8.2","new":"5.9"},{"seq":183348,"id":"CVE-2026-89711","ts":1789356674992,"field":"severity","old":"high","new":"medium"},{"seq":153600,"id":"CVE-2026-89711","ts":1789285351444,"field":"cvss","old":null,"new":"8.2"},{"seq":153599,"id":"CVE-2026-89711","ts":1789285351444,"field":"severity","old":"none","new":"high"},{"seq":147101,"id":"CVE-2026-89711","ts":1789270195174,"field":"cvss","old":null,"new":"5.9"},{"seq":147100,"id":"CVE-2026-89711","ts":1789270195174,"field":"severity","old":"none","new":"medium"},{"seq":108848,"id":"CVE-2026-89711","ts":1789183729239,"field":"cvss","old":null,"new":"5.9"},{"seq":108847,"id":"CVE-2026-89711","ts":1789183729239,"field":"severity","old":"none","new":"medium"}]}