The Linux kernel NFSD vulnerability (CVE-2026-89711) stems from an incorrect WARN_ON_ONCE check in the nfsd_mode_check() function. The original assumption that justified this warning was invalid in cases of NFS reexport, where nfsd_mode_check() may encounter a dentry without a valid i_op->lookup method pointer. The fix removes the WARN_ON_ONCE but retains the nfserr_notdir return code, which prevents a NULL pointer dereference during subsequent lookup operations by guarding calls to inode->i_op->lookup().

If unmitigated, the flawed WARN_ON_ONCE could lead to a NULL pointer dereference in the NFSD code path during NFS filesystem exports, potentially causing kernel instability or crashes. However, the nfserr_notdir return code remains in place to prevent dereferencing a NULL method pointer, mitigating the risk of exploitation.

A fix has been applied to the Linux kernel to remove the flawed WARN_ON_ONCE check while preserving the error handling that prevents NULL pointer dereferences. Users should update to the fixed kernel version containing commit e75b23f9e323 or later. No additional mitigation is required beyond applying this official fix.