Executive brief
The Linux kernel's lockd file locking service has a use-after-free vulnerability in its file iteration logic. When the kernel traverses lock records during NFS file locking operations, it can incorrectly access memory that was freed by a concurrent operation, potentially crashing the system or allowing an attacker to execute code. This affects any Linux system running NFS with file locking enabled.
Technical details
The vulnerability is a use-after-free in the nlm_traverse_files() function in fs/lockd/svcsubs.c. The lockd service iterates over files holding file locks while dropping and re-acquiring the nlm_file_mutex. The code pinned the current file with f_count++ across the mutex_unlock, but the next pointer in the linked list was not pinned. A concurrent nlm_release_file() call could kfree the next file during the unlock window, causing the iterator to dereference freed memory on the next loop iteration. The fix pins both current and next pointers before dropping the mutex, and uses pointer swapping to maintain liveness. Network-reachable via NFS locking requests; no authentication required. An attacker can trigger denial of service or potentially achieve code execution through memory corruption.
Affected products
- Linux Linux kernel Multiple versions; patch released 2026-09-14
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-09-14: patched: Fix committed upstream and in stable kernels