CVE-2026-72219lockd: Plug nlm_file leak when nlm_do_fopen() fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e580323ac0b51ad10ec2e181d1f777479b7983e7 before bca74fff138429f3d5802865f38fc883d53a4f1a; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before d7c677feb3aa1f42b1026d75a8ea61338b51e4fb; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 39f59bf67231ed2eb0cdf6337194360e964b609a; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before ddfbd816273b4e9c9b836f5b8773664c6f40f807; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 1403f1221a35a6caf959bb7bf005741f17263c66; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 1161c4b5bd0048c8148e919f818a33cff3623ef0; 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 builds before 3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before f16a1513452edb532fec81e591c64c320866719c; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/bca74fff138429f3d5802865f38fc883d53a4f1a
- https://git.kernel.org/stable/c/d7c677feb3aa1f42b1026d75a8ea61338b51e4fb
- https://git.kernel.org/stable/c/39f59bf67231ed2eb0cdf6337194360e964b609a
- https://git.kernel.org/stable/c/ddfbd816273b4e9c9b836f5b8773664c6f40f807
- https://git.kernel.org/stable/c/1403f1221a35a6caf959bb7bf005741f17263c66
- https://git.kernel.org/stable/c/1161c4b5bd0048c8148e919f818a33cff3623ef0
- https://git.kernel.org/stable/c/3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9
- https://git.kernel.org/stable/c/f16a1513452edb532fec81e591c64c320866719c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.