---
title: "CVE-2026-89711: Linux kernel NFSD - Broken Authentication"
description: "Linux kernel NFSD contains a broken authentication vulnerability caused by flawed WARN_ON_ONCE usage in nfsd_mode_check, letting attackers cause improper error handling during NFS reexport, exploit requires NFS filesystem export with specific dentry conditions."
url: https://panop.io/threat-heartbeat/CVE-2026-89711/
---

# CVE-2026-89711 Linux kernel NFSD - Broken Authentication

Linux kernel NFSD contains a broken authentication vulnerability caused by flawed WARN\_ON\_ONCE usage in nfsd\_mode\_check, letting attackers cause improper error handling during NFS reexport, exploit requires NFS filesystem export with specific dentry conditions.

CVSS base score 8.2 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Not required

EPSS

0.44% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89711)

## Details

Type

Broken Authentication

Impact

Denial Of Service

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the fix that removes WARN\_ON\_ONCE from nfsd\_mode\_check.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89711](https://nvd.nist.gov/vuln/detail/CVE-2026-89711)
- [https://git.kernel.org/stable/c/9f4434893a2783f7384d993cea883aff3fb7a52d](https://git.kernel.org/stable/c/9f4434893a2783f7384d993cea883aff3fb7a52d)
- [https://git.kernel.org/stable/c/ae251937c6f0237e5b555a5e4ba4595b8206e865](https://git.kernel.org/stable/c/ae251937c6f0237e5b555a5e4ba4595b8206e865)
- [https://git.kernel.org/stable/c/e145e8d67a5d41c72d322e7f87ab474d39d9dfb7](https://git.kernel.org/stable/c/e145e8d67a5d41c72d322e7f87ab474d39d9dfb7)
- [https://git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009](https://git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009)
- [https://git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c](https://git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c)
- [https://git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e](https://git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e)
- [https://git.kernel.org/stable/c/b55b4d880bb080fa10eb08ba21a5d8679b8102fe](https://git.kernel.org/stable/c/b55b4d880bb080fa10eb08ba21a5d8679b8102fe)
- [https://git.kernel.org/stable/c/2ef131323999539038e306773c8256403834361b](https://git.kernel.org/stable/c/2ef131323999539038e306773c8256403834361b)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)