{"id":"CVE-2026-72218","title":"lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure\n\nThe cached-file path in nlm_lookup_file() reaches the found: label\nunconditionally, even when nlm_d…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e580323ac0b51ad10ec2e181d1f777479b7983e7 < 6cd84cefd8b73e85b9eda17b319bd40a670f3a38","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < fe3b45b56b6c3d4b6b341de27fa291005287a21c","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < cb3420c047957e565101585bb4f15e1a6e3de6b0","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 7ce4c23e783e766507b2cef27bbf97e9ca944f1a","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 84008bf1860e0ef8059a7583a1163f36b704d08a","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 46d59ff421824b6483549d87f14efffbbbd1f6cb","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 3a5c55a19cad62f2973be25fe96a1a9e7f618e8a","Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 70a38f87bed7f0694fd07988b47b2db1e10d8df3","Linux >= 5.10.220 < 5.10.261","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:52:45.774483Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:22.326Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72218","references":[{"url":"https://git.kernel.org/stable/c/6cd84cefd8b73e85b9eda17b319bd40a670f3a38"},{"url":"https://git.kernel.org/stable/c/fe3b45b56b6c3d4b6b341de27fa291005287a21c"},{"url":"https://git.kernel.org/stable/c/cb3420c047957e565101585bb4f15e1a6e3de6b0"},{"url":"https://git.kernel.org/stable/c/7ce4c23e783e766507b2cef27bbf97e9ca944f1a"},{"url":"https://git.kernel.org/stable/c/84008bf1860e0ef8059a7583a1163f36b704d08a"},{"url":"https://git.kernel.org/stable/c/46d59ff421824b6483549d87f14efffbbbd1f6cb"},{"url":"https://git.kernel.org/stable/c/3a5c55a19cad62f2973be25fe96a1a9e7f618e8a"},{"url":"https://git.kernel.org/stable/c/70a38f87bed7f0694fd07988b47b2db1e10d8df3"}],"tags":["cve.org"],"epss":0.00216,"epssPercentile":0.12157,"ingestedAt":"2026-11-06T18:00:12.590Z","slug":"CVE-2026-72218","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure\n\nThe cached-file path in nlm_lookup_file() reaches the found: label\nunconditionally, even when nlm_do_fopen() fails. At that label\n*result and file->f_count are updated before the error is returned.\nThe wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then\nbail out of their switch without copying *result back to their\ncaller, so the proc handler's local nlm_file pointer remains NULL\nand the cleanup path skips nlm_release_file(). The f_count\nincrement is never released, and nlm_traverse_files() can no\nlonger reap the file because its refcount never returns to zero\nbetween requests.\n\nShort-circuit the cached path so neither *result nor f_count is\ntouched when nlm_do_fopen() fails on a hashed nlm_file.\n\n## Affected\n\n- `Linux >= e580323ac0b51ad10ec2e181d1f777479b7983e7 < 6cd84cefd8b73e85b9eda17b319bd40a670f3a38`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < fe3b45b56b6c3d4b6b341de27fa291005287a21c`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < cb3420c047957e565101585bb4f15e1a6e3de6b0`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 7ce4c23e783e766507b2cef27bbf97e9ca944f1a`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 84008bf1860e0ef8059a7583a1163f36b704d08a`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 46d59ff421824b6483549d87f14efffbbbd1f6cb`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 3a5c55a19cad62f2973be25fe96a1a9e7f618e8a`\n- `Linux >= 7f024fcd5c97dc70bb9121c80407cf3cf9be7159 < 70a38f87bed7f0694fd07988b47b2db1e10d8df3`\n- `Linux >= 5.10.220 < 5.10.261`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}