Linux Kernel NFS EUVD-2026-28776

The vulnerability resides in the NFS (Network File System) client subsystem of the Linux kernel, specifically in nfs3_proc_create and the call chain through nfs3_do_create → nfs_add_or_obtain → d_splice_alias. The function d_splice_alias is designed to return either a directory alias dentry or NULL; when it returns a directory alias, the pre-fix code failed to detect this condition and returned without propagating an error. This left the caller's original dentry pointer in a 'negative' state - meaning it has no associated inode. The subsequent open path in nfs_atomic_open_v23 passes this negative dentry to finish_open and ultimately do_dentry_open, which does not handle negative dentries gracefully and produces a kernel oops (effectively a NULL dereference or invalid inode access). The fix introduces an explicit d_is_dir() check after d_splice_alias to detect directory aliases and return EISDIR, preventing file operations from proceeding on a directory inode. No CWE is formally assigned; the closest classifications are CWE-476 (NULL Pointer Dereference) and CWE-755 (Improper Handling of Exceptional Conditions). CPE: cpe:2.3:a:linux:linux.