CVE-2026-72218

Received Received - Intake

Refcount Leak in Linux Kernel NLM File Handling

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72218

EUVD

EUVD-2026-58976

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a reference count leak occurs in the lockd component. When nlm_do_fopen() fails, the code incorrectly updates file references and increments a counter without releasing it. This prevents proper cleanup, causing the file to remain unreleased and potentially leading to resource exhaustion.

Detection Guidance

This vulnerability is specific to the Linux kernel's lockd subsystem and may not have direct detection commands. Monitoring for unusual file handle leaks or refcount mismatches in lockd processes could indicate exploitation. Check kernel logs for lockd-related errors or crashes.

Impact Analysis

The vulnerability could cause system instability by leaking file references, leading to resource exhaustion. This might result in performance degradation, crashes, or denial of service in systems using NFS (Network File System) with lockd services.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a Linux kernel memory leak in the lockd subsystem. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the lockd refcount leak. Restart services using lockd to ensure the patched kernel is active. Monitor system stability and lockd performance post-update.

Hi! I’m here to help you understand CVE-2026-72218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70