EUVD-2026-76623
GHSA-f2q5-7q65-xqx7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Requires NFS re-export server configuration (AC:H), host-authorized NFS client (PR:L), and panic_on_warn=1 for full DoS; no confidentiality impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport).
When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).
So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.
AnalysisAI
Linux kernel NFS server (NFSD) contains a spurious WARN_ON_ONCE in nfsd_mode_check() that fires when an authorized NFS client performs a LOOKUP on a re-exported NFS filesystem whose dentry legitimately lacks i_op->lookup (mountpoints, V4 referrals). On systems configured with panic_on_warn=1 - common in production-hardened Linux deployments - this constitutes a remotely triggerable kernel panic and full availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The server must be configured as an NFS re-export server, meaning it must have an NFS-mounted filesystem (or subdirectory thereof) listed in /etc/exports and actively served to clients - a deliberately configured, non-default deployment mode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 8.2 High) significantly overstates real-world risk on multiple dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel version: Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, query all Linux NFSD systems for panic_on_warn=1 status and identify those with active re-exported NFS filesystems (nested mount points or V4 referrals); immediately restrict NFS client access via firewall or export rules to critical systems pending patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today