CVE-2026-89484

Low risk· EPSS 10%

Published: 11/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In the Linux kernel, lockd's nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. The VFS still tears down the partially initialized file_lock and calls locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes (NULL dereference). The fix clears fl_ops before initialization and installs NLM operations only after a lockowner is allocated.

Risk Assessment

Can cause a kernel crash (NULL pointer dereference) and denial of service. Affects systems using NFS and lockd under memory pressure.

Recommendation

Update the Linux kernel to a version with the fix that clears fl_ops before initialization. Until patched, monitor memory usage on NFS servers.

Other vulnerabilities in Linux kernel (lockd)

CVE-2026-89485Critical
In the Linux kernel, lockd's nlm_traverse_files() pins the current file with f_count++ across a mutex unlock but does not pin the saved next pointer. A concurrent nlm_release_file() can free next during the unlock window, and the iterator dereferences freed memory on the next loop step. The fix pins both files and releases them after the iteration.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully.