Executive brief
The Linux kernel's NFS server (NFSD) component contains a null pointer dereference vulnerability in directory lookup handling that can cause a kernel crash or denial of service. This affects systems that export NFS filesystems, particularly when those filesystems themselves are mounted over NFS. An attacker with network access to an NFS-exported filesystem could trigger this condition and disrupt server availability.
Technical details
The vulnerability is a null pointer dereference in the NFSD layer's nfsd_mode_check() function when handling NFS reexport scenarios. The root cause is an invalid assumption in commit e75b23f9e323 that added a WARN_ON_ONCE check; this assumption breaks when NFSD exports an NFS-mounted filesystem, where directory dentries may legitimately lack the i_op->lookup method pointer (due to NFS_ATTR_FATTR_MOUNTPOINT or NFS_ATTR_FATTR_V4_REFERRAL handling). While the WARN_ON_ONCE was removed by the fix, the critical nfserr_notdir return statement was retained to guard against the subsequent lookup_one_unlocked() -> __lookup_slow() call that dereferences i_op->lookup() without a NULL check. A network-reachable NFS client can trigger a LOOKUP operation on such a dentry to crash the kernel.
Affected products
- Linux Linux kernel Linux 2.6.11 through Linux 6.x (affected versions vary; see git.kernel.org stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-06-12: patched: Upstream commit aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e
- 2026-09-07: other: Backported to linux-6.1.y stable
- 2026-09-14: other: Backported to additional stable branches