0.0
NA
CVE-2026-72218
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.
Details
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix a refcount leak in lockd by short-circuiting the cached file path on failure.
- Apply the Linux kernel patch for lockd.
- Ensure nlm_do_fopen() failure does not update f_count.
- Prevent refcount increment on hashed nlm_file.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72218.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72218 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72218
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72218 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72218 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e580323ac0b51ad10ec2e181d1f777479b7983e7', 'lessThan': '6cd84cefd8b73e85b9eda17b319bd40a670f3a38', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'fe3b45b56b6c3d4b6b341de27fa291005287a21c', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'cb3420c047957e565101585bb4f15e1a6e3de6b0', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '7ce4c23e783e766507b2cef27bbf97e9ca944f1a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '84008bf1860e0ef8059a7583a1163f36b704d08a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '46d59ff421824b6483549d87f14efffbbbd1f6cb', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '3a5c55a19cad62f2973be25fe96a1a9e7f618e8a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '70a38f87bed7f0694fd07988b47b2db1e10d8df3', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.261', 'versionType': 'semver'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e580323ac0b51ad10ec2e181d1f777479b7983e7', 'lessThan': '6cd84cefd8b73e85b9eda17b319bd40a670f3a38', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'fe3b45b56b6c3d4b6b341de27fa291005287a21c', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'cb3420c047957e565101585bb4f15e1a6e3de6b0', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '7ce4c23e783e766507b2cef27bbf97e9ca944f1a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '84008bf1860e0ef8059a7583a1163f36b704d08a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '46d59ff421824b6483549d87f14efffbbbd1f6cb', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '3a5c55a19cad62f2973be25fe96a1a9e7f618e8a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '70a38f87bed7f0694fd07988b47b2db1e10d8df3', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.261', 'versionType': 'semver'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e580323ac0b51ad10ec2e181d1f777479b7983e7', 'lessThan': '6cd84cefd8b73e85b9eda17b319bd40a670f3a38', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'fe3b45b56b6c3d4b6b341de27fa291005287a21c', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': 'cb3420c047957e565101585bb4f15e1a6e3de6b0', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '7ce4c23e783e766507b2cef27bbf97e9ca944f1a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '84008bf1860e0ef8059a7583a1163f36b704d08a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '46d59ff421824b6483549d87f14efffbbbd1f6cb', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '3a5c55a19cad62f2973be25fe96a1a9e7f618e8a', 'versionType': 'git'}, {'status': 'affected', 'version': '7f024fcd5c97dc70bb9121c80407cf3cf9be7159', 'lessThan': '70a38f87bed7f0694fd07988b47b2db1e10d8df3', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.261', 'versionType': 'semver'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/lockd/svcsubs.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. Added Reference https://git.kernel.org/stable/c/3a5c55a19cad62f2973be25fe96a1a9e7f618e8a Added Reference https://git.kernel.org/stable/c/46d59ff421824b6483549d87f14efffbbbd1f6cb Added Reference https://git.kernel.org/stable/c/6cd84cefd8b73e85b9eda17b319bd40a670f3a38 Added Reference https://git.kernel.org/stable/c/70a38f87bed7f0694fd07988b47b2db1e10d8df3 Added Reference https://git.kernel.org/stable/c/7ce4c23e783e766507b2cef27bbf97e9ca944f1a Added Reference https://git.kernel.org/stable/c/84008bf1860e0ef8059a7583a1163f36b704d08a Added Reference https://git.kernel.org/stable/c/cb3420c047957e565101585bb4f15e1a6e3de6b0 Added Reference https://git.kernel.org/stable/c/fe3b45b56b6c3d4b6b341de27fa291005287a21c
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.