CVE-2026-72218

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak exists in the lockd component. In the nlm lookup file() function, the cached-file path reaches the found label even if nlm do fopen() fails. This causes file->f count and *result to be updated before an error is returned. Consequently, the wrapper functions nlm3svc lookup file() and nlm4svc lookup file() exit without returning the result to the caller, leaving the local nlm file pointer as NULL. This prevents the cleanup path from calling nlm release file(), meaning the f count increment is never released. As a result, nlm traverse files() cannot reap the file because the reference count does not return to zero between requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.