Linux NFSD: bogus WARN_ON_ONCE fires on NFS re-export lookups

Impact

A WARN_ON_ONCE() added on the assumption that a directory dentry always has i_op->lookup is wrong when NFSD re-exports an NFS filesystem: mountpoints and v4 referrals legitimately produce such dentries. A client LOOKUP into one of those trips the warning. The nfserr_notdir return on that branch is correct and stays - it is what prevents a NULL i_op->lookup dereference further down - so the fix only removes the warning. Exposure is limited to re-export setups, and on a node booted with panic_on_warn a remote client can turn an ordinary lookup into a host panic, which is why the record scores availability high. Otherwise the effect is log noise and a tainted kernel.

Who can reach it

Any NFS client able to LOOKUP through a re-exported NFS mount on the server. No local access; export authentication applies. Only servers that re-export NFS are affected.

What to do

Apply the stable fix removing the WARN_ON_ONCE and reboot the node. As an interim measure on re-export servers, ensure panic_on_warn is not set so the warning cannot be escalated into a node outage. The record names stable commits, not a released version.

References

Related entries

• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel NVMe target authentication (nvmet-auth DH group setup): CtrlCVE-2024-50215 · Linux kernel NVMe target authentication (nvmet-auth DH group setup)High
• OpenSSH (sshd): regreSSHion: signal-handler race in sshd giving unauthenticated remote root on glibc LinuxCVE-2024-6387 · OpenSSH (sshd)High
• Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry'sCVE-2025-40168 · Linux kernel (net/smc)High