CVE-2026-74315

Received Received - Intake

Memory Corruption in Linux Kernel lockd

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pc_argzero to zero for the converted procedures and moved file-handle population into nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes into lock->fh.data. When an NLMv4 client presents a file handle shorter than LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlm_lookup_file() misses the existing nlm_file entry, and lock-state lookups fail. Zero only the tail bytes that file_hash() would otherwise consume. Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte that file_hash() reads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74315

EUVD

EUVD-2026-59462

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the lockd component where uninitialized bytes in file handles are hashed, leading to inconsistent bucketing of NLMv4 file handles. When a client presents a file handle shorter than expected, the hash function reads uninitialized memory, causing the same handle to hash to different buckets across requests. This results in failed lookups for existing lock-state entries.

Detection Guidance

This vulnerability affects the Linux kernel's lockd service, specifically when handling NLMv4 file handles. Detection requires checking kernel logs for lockd-related errors or failed lock-state lookups. Monitor for messages indicating inconsistent file handle hashing or missing nlm_file entries. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause lockd to fail in correctly identifying existing file locks, leading to race conditions or denial of service in NFS environments. Applications relying on NFS file locking may experience unexpected behavior, data corruption, or crashes due to failed lock state lookups.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel issue affecting file handle hashing in the lockd subsystem. No evidence suggests data exposure or unauthorized access risks that would violate these regulations.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description to resolve the issue. Update to a version of the Linux kernel that includes the fix for commit 3de744ee4e45. Restart services dependent on lockd after patching.

Hi! I’m here to help you understand CVE-2026-74315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70