CVE-2026-72219 — lockd: Plug nlm_file leak when nlm_do_fopen() fails
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures b…
Published: 2026-08-15 · CVSS: Unscored
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7