# NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

CVE record · `CVE-2026-89711`

- **Identifiers:** `CVE-2026-89711`
- **State:** Confirmed
- **Severity:** CVSS 8.2 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 11 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before ae251937c6f0237e5b555a5e4ba4595b8206e865` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before e145e8d67a5d41c72d322e7f87ab474d39d9dfb7` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 9f4434893a2783f7384d993cea883aff3fb7a52d` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 2ef131323999539038e306773c8256403834361b` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before b55b4d880bb080fa10eb08ba21a5d8679b8102fe` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before 7ef182a8fe9c12b0d936880b1e504840639aa009` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before a275de3bac5635514ca830f2e46b5ff0e66b5c4c` (git)
  - affected: `e75b23f9e323b1e0759619c39d5a9f7a3a5d9d2c to before aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.8`
  - unaffected: `before 4.8` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.109 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.50 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.4 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.2 High, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0044, the 39th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89711](https://www.cve.org/CVERecord?id=CVE-2026-89711)
- [NVD: CVE-2026-89711](https://nvd.nist.gov/vuln/detail/CVE-2026-89711)

### References from the CNA

- <https://git.kernel.org/stable/c/ae251937c6f0237e5b555a5e4ba4595b8206e865>
- <https://git.kernel.org/stable/c/e145e8d67a5d41c72d322e7f87ab474d39d9dfb7>
- <https://git.kernel.org/stable/c/9f4434893a2783f7384d993cea883aff3fb7a52d>
- <https://git.kernel.org/stable/c/2ef131323999539038e306773c8256403834361b>
- <https://git.kernel.org/stable/c/b55b4d880bb080fa10eb08ba21a5d8679b8102fe>
- <https://git.kernel.org/stable/c/7ef182a8fe9c12b0d936880b1e504840639aa009>
- <https://git.kernel.org/stable/c/a275de3bac5635514ca830f2e46b5ff0e66b5c4c>
- <https://git.kernel.org/stable/c/aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89711>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89711/>. Everything for agents: <https://agentprime.io/llms.txt>.