Executive brief
The Linux kernel's network lock daemon (lockd) manages file locks for NFS clients. A memory allocation failure during lock setup can cause the system to crash with a NULL pointer dereference when attempting to release partially initialized lock structures, disrupting NFS file locking operations and causing service interruption.
Technical details
The vulnerability is a NULL pointer dereference in the lockd subsystem. The root cause is in nlmclnt_locks_init_private() in fs/lockd/clntproc.c, which installs NLM file lock operations via fl_ops before verifying that nlmclnt_find_lockowner() successfully allocated a lockowner. When lockowner allocation fails and returns NULL, nlmclnt_proc() returns -ENOMEM, but the VFS still invokes locks_release_private() during cleanup. This calls nlmclnt_locks_release_private(), which attempts to dereference fl->fl_u.nfs_fl.owner without checking for NULL, causing a crash. The fix clears fl_ops before initialization and only installs the NLM lock operations after a lockowner is successfully allocated. This is a local denial-of-service vulnerability requiring no special privileges or network access—any process that triggers NFS file locking during memory pressure can cause a kernel panic.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later
Timeline
- 2026-09-11: disclosed
- 2026-08-17: patched: Fix committed upstream
- 2026-09-07: patched: Included in stable releases