CVE-2026-72218
Description
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.
How to fix
- Linux Linux6cd84cefd8b73e85b9eda17b319bd40a670f3a38, fe3b45b56b6c3d4b6b341de27fa291005287a21c, cb3420c047957e565101585bb4f15e1a6e3de6b0, 7ce4c23e783e766507b2cef27bbf97e9ca944f1a, 84008bf1860e0ef8059a7583a1163f36b704d08a, 46d59ff421824b6483549d87f14efffbbbd1f6cb, 3a5c55a19cad62f2973be25fe96a1a9e7f618e8a, 70a38f87bed7f0694fd07988b47b2db1e10d8df3, 5.10.261 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e580323ac0b51ad10ec2e181d1f777479b7983e7 ≤ v < 6cd84cefd8b73e85b9eda17b319bd40a670f3a38, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < fe3b45b56b6c3d4b6b341de27fa291005287a21c, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < cb3420c047957e565101585bb4f15e1a6e3de6b0, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < 7ce4c23e783e766507b2cef27bbf97e9ca944f1a, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < 84008bf1860e0ef8059a7583a1163f36b704d08a, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < 46d59ff421824b6483549d87f14efffbbbd1f6cb, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < 3a5c55a19cad62f2973be25fe96a1a9e7f618e8a, 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 ≤ v < 70a38f87bed7f0694fd07988b47b2db1e10d8df3, 5.10.220 ≤ v < 5.10.261, 5.15 | 6cd84cefd8b73e85b9eda17b319bd40a670f3a38, fe3b45b56b6c3d4b6b341de27fa291005287a21c, cb3420c047957e565101585bb4f15e1a6e3de6b0, 7ce4c23e783e766507b2cef27bbf97e9ca944f1a, 84008bf1860e0ef8059a7583a1163f36b704d08a, 46d59ff421824b6483549d87f14efffbbbd1f6cb, 3a5c55a19cad62f2973be25fe96a1a9e7f618e8a, 70a38f87bed7f0694fd07988b47b2db1e10d8df3, 5.10.261 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.