CVE-2026-89711: Linux Kernel NFSD Directory Lookup Flaw

CVE-2026-89711 is a directory lookup vulnerability in the Linux kernel NFSD component that affects NFS filesystem reexports. The flaw involves incorrect validation that could lead to NULL pointer issues. This article covers technical details, affected kernel versions, impact analysis, and mitigation strategies.

CVE-2026-89711 Overview

CVE-2026-89711 is a Linux kernel vulnerability in the NFS server (NFSD) subsystem. The flaw resides in the nfsd_mode_check() function, where a flawed WARN_ON_ONCE assertion can be triggered by a remote NFS client. When NFSD re-exports an NFS filesystem, a dentry may legitimately lack an i_op->lookup operation, which invalidates the assumption behind the warning added in commit e75b23f9e323. Remote attackers on the network can reach this code path through standard NFS LOOKUP operations, causing kernel log spam and availability impact on the NFS server.

Critical Impact
A remote, unauthenticated NFS client can trigger WARN_ON_ONCE splats in nfsd_mode_check() against re-exported NFS filesystems, degrading server availability.

Affected Products

Linux kernel NFSD subsystem (nfsd module)
Systems re-exporting NFS filesystems via NFSD
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89711 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89711

Vulnerability Analysis

The vulnerability lives in the NFS server's file handle verification path. Commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") added a WARN_ON_ONCE() to nfsd_mode_check() under the assumption that any dentry reaching that branch would always have an i_op->lookup method. That assumption breaks when NFSD re-exports another NFS filesystem.

When NFSD serves a re-exported NFS mount, nfs_fhget() handles cases flagged with NFS_ATTR_FATTR_MOUNTPOINT or NFS_ATTR_FATTR_V4_REFERRAL. The resulting dentries, marked through d_flags_for_inode(), may not expose a lookup inode operation. When a client issues a LOOKUP against such an object, nfsd_mode_check() reaches the branch guarded by the warning and emits a kernel splat.

The branch itself still needs to return nfserr_notdir. That return protects the downstream lookup_one_unlocked() -> __lookup_slow() code path, which invokes inode->i_op->lookup() without a NULL check. Removing the return would introduce a NULL function pointer dereference on the same input.

Root Cause

The root cause is an incorrect invariant encoded as a WARN_ON_ONCE in kernel code. The developer assumed all directory-like dentries handled by NFSD have i_op->lookup, but NFS re-export scenarios legitimately violate this invariant. Client-reachable code paths should never rely on WARN_ON_ONCE for conditions attackers can trigger.

Attack Vector

A remote NFS client, without authentication in typical NFSv3 exports, issues LOOKUP operations against a re-exported NFS filesystem containing mountpoint or v4 referral dentries. Each triggering request produces kernel warning output and consumes availability resources on the NFS server, contributing to the high availability impact rating.

No verified proof-of-concept code is publicly available. Refer to the upstream fix commits including Kernel Commit Bug Fix and Kernel Commit Security Improvement for the exact code change.

Detection Methods for CVE-2026-89711

Indicators of Compromise

Kernel log entries containing WARN_ON_ONCE stack traces originating from nfsd_mode_check on NFS servers
Repeated nfserr_notdir responses returned by NFSD to specific clients performing LOOKUP operations
Elevated dmesg volume on hosts running nfsd that also mount remote NFS shares for re-export

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for stack traces referencing nfsd_mode_check and fh_verify
Correlate NFS server warning bursts with source IP addresses recorded by rpc.mountd and nfsdclnts telemetry
Audit systems where NFSD exports paths that are themselves NFS mounts, since only these are exposed to the flawed code path

Monitoring Recommendations

Alert on new WARN_ON_ONCE entries in kernel ring buffers on production NFS servers
Track NFSD error rates and LOOKUP response codes through node-exporter or equivalent telemetry
Baseline expected NFS re-export traffic patterns and flag anomalous LOOKUP volume from single clients

How to Mitigate CVE-2026-89711

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected NFS servers
Inventory hosts that re-export NFS filesystems, since these are the exposed configurations
Restrict NFS exports to trusted client networks using /etc/exports host specifications and firewall rules on TCP/UDP 2049

Patch Information

The fix removes the flawed WARN_ON_ONCE() from nfsd_mode_check() while preserving the nfserr_notdir return that guards the downstream NULL dereference. Patches are available across stable branches through the following commits: Kernel Commit Update, Kernel Commit Refactor, Kernel Commit Bug Fix, Kernel Commit Security Improvement, Kernel Commit Performance Patch, Kernel Commit Device Driver Change, Kernel Commit Stability Enhancement, and Kernel Commit Feature Addition. Apply the vendor-provided kernel package that includes these commits for your distribution.

Workarounds

Avoid re-exporting NFS filesystems through NFSD until the patched kernel is deployed
Limit NFSD exports to clients that do not perform LOOKUP operations against mountpoint or v4 referral objects
Restrict NFS server accessibility with network segmentation and host-based firewall rules such as iptables or nftables filters on the NFS ports