CVE-2026-89711

In the Linux kernel, the following vulnerability has been resolved:

NFSD: remove flawed WARN ON ONCE from nfsd mode check

The header for commit e75b23f9e323 ("nfsd: check d can lookup in fh verify of directories") details the assumption that justified adding the WARN ON ONCE to nfsd mode check(), that assumption is invalid (in the case of NFS reexport).

When NFSD exports an NFS filesystem it is very possible for nfsd mode check() to encounter a @dentry that doesn't have i op->lookup (see nfs fhget()'s NFS ATTR FATTR MOUNTPOINT and NFS ATTR FATTR V4 REFERRAL handling, and d flags for inode()).

So remove nfsd mode check()'s WARN ON ONCE(). The nfserr notdir return on that branch must stay. It guards the subsequent lookup one unlocked() -> lookup slow() path, which calls inode->i op->lookup() with no NULL check, so returning nfserr notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.