CVE-2026-72218

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

The cached-file path in nlm_lookup_file() reaches the found: label

unconditionally, even when nlm_do_fopen() fails. At that label

*result and file->f_count are updated before the error is returned.

The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then

bail out of their switch without copying *result back to their

caller, so the proc handler's local nlm_file pointer remains NULL

and the cleanup path skips nlm_release_file(). The f_count

increment is never released, and nlm_traverse_files() can no

longer reap the file because its refcount never returns to zero

between requests.

Short-circuit the cached path so neither *result nor f_count is

touched when nlm_do_fopen() fails on a hashed nlm_file.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References