lockd: Plug nlm_file leak when nlm_do_fopen() fails (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.
References
- https://git.kernel.org/stable/c/bca74fff138429f3d5802865f38fc883d53a4f1a
- https://git.kernel.org/stable/c/d7c677feb3aa1f42b1026d75a8ea61338b51e4fb
- https://git.kernel.org/stable/c/39f59bf67231ed2eb0cdf6337194360e964b609a
- https://git.kernel.org/stable/c/ddfbd816273b4e9c9b836f5b8773664c6f40f807
- https://git.kernel.org/stable/c/1403f1221a35a6caf959bb7bf005741f17263c66
- https://git.kernel.org/stable/c/1161c4b5bd0048c8148e919f818a33cff3623ef0
- https://git.kernel.org/stable/c/3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9
- https://git.kernel.org/stable/c/f16a1513452edb532fec81e591c64c320866719c
European references
- ENISA EUVD · EUVD-2026-59118
- GCVE · GCVE-0-2026-72219
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1372 — Multiples vulnérabilités dans les produits SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1335 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e580323ac0b51ad10ec2e181d1f777479b7983e7 < bca74fff138429f3d5802865f38fc883d53a4f1a ; affected 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < d7c677feb3aa1f42b1026d75a8ea61338b51e4fb ; affected 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 39f59bf67231ed2eb0cdf6337194360e964b609a ; affected 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < ddfbd816273b4e9c9b836f5b8773664c6f40f807 ; affected 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 1403f1221a35a6caf959bb7bf005741f17263c66 ; affected 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 1161c4b5bd0048c8148e919f818a33cff3623ef0 |
| Linux · Linux | affected 5.15 ; unaffected 0 < 5.15 ; unaffected 5.10.261 ≤ 5.10.* ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |