CVE-2026-74315

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of

nfs_fh.data when bucketing nlm_files[], independent of fh.size.

Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the

NLMv4 TEST procedure") set .pc_argzero to zero for the converted

procedures and moved file-handle population into

nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes

into lock->fh.data.

When an NLMv4 client presents a file handle shorter than

LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument

buffer held from an earlier request. The same wire handle then

hashes to different buckets across calls; nlm_lookup_file() misses

the existing nlm_file entry, and lock-state lookups fail.

Zero only the tail bytes that file_hash() would otherwise consume.

Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte

that file_hash() reads.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References