Not yet scoredPublished Aug 15, 2026

CVE-2026-72219lockd: Plug nlm_file leak when nlm_do_fopen() fails

Updated under an hour ago (Oct 28, 2026, 5:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e580323ac0b51ad10ec2e181d1f777479b7983e7 before bca74fff138429f3d5802865f38fc883d53a4f1a; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before d7c677feb3aa1f42b1026d75a8ea61338b51e4fb; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 39f59bf67231ed2eb0cdf6337194360e964b609a; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before ddfbd816273b4e9c9b836f5b8773664c6f40f807; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 1403f1221a35a6caf959bb7bf005741f17263c66; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before 1161c4b5bd0048c8148e919f818a33cff3623ef0; 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 builds before 3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9; from 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 before f16a1513452edb532fec81e591c64c320866719c; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/bca74fff138429f3d5802865f38fc883d53a4f1a
https://git.kernel.org/stable/c/d7c677feb3aa1f42b1026d75a8ea61338b51e4fb
https://git.kernel.org/stable/c/39f59bf67231ed2eb0cdf6337194360e964b609a
https://git.kernel.org/stable/c/ddfbd816273b4e9c9b836f5b8773664c6f40f807
https://git.kernel.org/stable/c/1403f1221a35a6caf959bb7bf005741f17263c66
https://git.kernel.org/stable/c/1161c4b5bd0048c8148e919f818a33cff3623ef0
https://git.kernel.org/stable/c/3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9
https://git.kernel.org/stable/c/f16a1513452edb532fec81e591c64c320866719c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.