CVE-2026-89711

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). An invalid assumption in the nfsd_mode_check() function regarding directory lookup capabilities during NFS reexport could lead to a null pointer dereference. A remote attacker could exploit this by performing a LOOKUP operation on a specially crafted NFS reexport, potentially causing a system crash and resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel's Network File System Daemon (NFSD), affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 8, 9, and 10, as well as OpenShift Container Platform releases whose nodes ship a Red Hat Enterprise Linux kernel through Red Hat Enterprise Linux CoreOS. When NFSD is configured to re-export an NFS filesystem, nfsd_mode_check() can encounter a directory entry that does not provide a lookup operation (i_op->lookup). A remote NFS client could then trigger a NULL pointer dereference by issuing a LOOKUP request against such an entry, crashing the kernel and causing a denial of service. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream, and Red Hat Enterprise Linux 6 is out of support scope. Red Hat rates this flaw MODERATE (CVSS 5.5) while the CVE program assigns 8.2 (Important); the difference reflects Red Hat's assessment of the prerequisites and impact, as triggering the flaw requires the uncommon NFSD NFS re-export configuration and the consequence is limited to availability. Because the impact is MODERATE with a CVSS score below the tracking threshold, fixes for the affected streams are deferred; the residual risk is a remote denial of service (kernel crash) limited to servers configured for NFS re-export, with no impact to confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid configuring NFSD to re-export NFS filesystems, that is, do not export filesystems that are themselves NFS mounts. This flaw is only reachable when nfsd_mode_check() processes directory entries originating from an NFS re-export, so limiting NFSD exports to local filesystems prevents a remote NFS client from triggering the NULL pointer dereference. Apart from this configuration change, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.