Executive brief
The Linux kernel's lockd (network lock daemon) service, which manages file locks over NFS, suffers from a flaw where uninitialized memory bytes are included in file handle comparisons for NLMv4 clients. When an NLMv4 client sends a file handle shorter than the hash buffer size, leftover data from prior requests contaminates the lookup process, causing legitimate lock operations to fail and preventing clients from accessing or modifying locked files correctly.
Technical details
The vulnerability is an information disclosure and data corruption issue in the lockd subsystem's file-handle hashing logic. The file_hash() function always digests the first 32 bytes of nfs_fh.data when bucketing nlm_files[], but nlm4svc_lookup_file() copies only xdr_lock->fh.len bytes into the buffer. When an NLMv4 client presents a file handle shorter than 32 bytes, the remaining bytes retain whatever data was in the argument buffer from earlier requests. This causes the same wire file handle to hash to different buckets across calls, making nlm_lookup_file() unable to locate existing lock state entries. The fix zeroes out uninitialized tail bytes in the file handle buffer before hashing, ensuring consistent hash bucket placement. No authentication or special privileges are required; any NLMv4 client can trigger this by sending short file handles.
Affected products
- Linux Linux kernel All versions affected by commit 3de744ee4e45 and later; fixed in 6.10.1 and later stable series
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: Upstream fix merged
- 2026-05-14: other: Vulnerability reported by Jeff Layton