Linux NFSD: bogus WARN_ON_ONCE fires on NFS re-export lookups

CVSS 8.2CVE-2026-89711Kernel, userspace & hypervisorcurated

Impact

A WARN_ON_ONCE() added on the assumption that a directory dentry always has i_op->lookup is wrong when NFSD re-exports an NFS filesystem: mountpoints and v4 referrals legitimately produce such dentries. A client LOOKUP into one of those trips the warning. The nfserr_notdir return on that branch is correct and stays - it is what prevents a NULL i_op->lookup dereference further down - so the fix only removes the warning. Exposure is limited to re-export setups, and on a node booted with panic_on_warn a remote client can turn an ordinary lookup into a host panic, which is why the record scores availability high. Otherwise the effect is log noise and a tainted kernel.

Who can reach it

Any NFS client able to LOOKUP through a re-exported NFS mount on the server. No local access; export authentication applies. Only servers that re-export NFS are affected.

What to do

Apply the stable fix removing the WARN_ON_ONCE and reboot the node. As an interim measure on re-export servers, ensure panic_on_warn is not set so the warning cannot be escalated into a node outage. The record names stable commits, not a released version.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89711 https://git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009 https://git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c https://git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.