lockd: Plug nlm_file leak when nlm_do_fopen() fails

Summary

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.

Timeline

1. Aug 15, 2026, 5:54 AM UTCCVE published
2. Aug 17, 2026, 5:10 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 5.10.220 · fixed in 5.10.261

• Linux Linux

  5.15

References 8