CVE-2026-89711: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89711 is a NULL pointer dereference vulnerability in the Linux kernel's NFSD (NFS server daemon) subsystem, specifically within the nfsd_mode_check() function. The flaw stems from a flawed WARN_ON_ONCE assertion introduced by commit e75b23f9e323 that incorrectly assumes all directory dentries will have an i_op->lookup method — an assumption that is invalid in NFS reexport scenarios. Affected kernel versions begin at 4.8 (when the flawed commit was introduced) and extend through multiple stable branches prior to the fixes in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. The vulnerability was disclosed on September 11, 2026, with an EPSS score of 0.0 and a CVSS estimate of Medium severity (GitHub Advisory, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When NFSD re-exports an NFS filesystem, nfsd_mode_check() can encounter a dentry that lacks an i_op->lookup method — this occurs due to how nfs_fhget() handles NFS_ATTR_FATTR_MOUNTPOINT, NFS_ATTR_FATTR_V4_REFERRAL, and d_flags_for_inode(). The flawed WARN_ON_ONCE fires in this scenario, but more critically, if the nfserr_notdir return were also removed, the subsequent lookup_one_unlocked() -> __lookup_slow() code path would call inode->i_op->lookup() with no NULL check, resulting in a NULL pointer dereference. The fix removes only the WARN_ON_ONCE while retaining the nfserr_notdir return to prevent the NULL dereference (GitHub Advisory, Feedly).

The primary impact is denial of service: any NFS client performing LOOKUP requests against an NFSD instance that re-exports an NFS filesystem can repeatedly trigger the faulty WARN_ON_ONCE assertion, generating kernel warnings that degrade system performance. In the worst case, if the protective nfserr_notdir return were absent, a NULL pointer dereference could cause a kernel panic. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability of the affected NFS server (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to send NFS LOOKUP requests to a server configured to re-export an NFS filesystem, which limits the attack surface to environments with that specific configuration (Feedly).

Patches have been applied to the following stable kernel branches: 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. The fix removes the flawed WARN_ON_ONCE from nfsd_mode_check() while retaining the nfserr_notdir return to prevent NULL pointer dereference. Administrators running NFSD with NFS re-export configurations should update to a patched kernel version as soon as possible. As a temporary workaround, disabling NFS re-export functionality (if operationally feasible) eliminates the attack surface (GitHub Advisory, Red Hat Bugzilla).