CVE-2024-26629 Linux CVE debrief

Who should care

Administrators and vendors running Linux kernels with NFS server (nfsd) enabled, especially environments that handle NFSv4 lock-owner cleanup. Downstream distribution maintainers and appliance vendors should prioritize patched kernel builds for affected releases.

Technical summary

The vulnerability is in nfsd4_release_lockowner(). The code path used so_count to decide whether a lock owner still had locks, but so_count can include transient references and other state, so the check could falsely report NFS4ERR_LOCKS_HELD. The supplied fix description says the logic was reverted to check_for_locks(), and that helper was changed to use find_any_file_locked() so it does not take an extra nfs4_file reference or sleep. NVD maps the issue to CWE-667 and CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

Medium. The issue requires local access to interact with the affected NFS server path, but it can break lock-owner release behavior and cause availability and protocol-correctness problems on exposed systems.

Recommended defensive actions

• Apply the kernel update or vendor backport that includes the nfsd RELEASE_LOCKOWNER fix.
• Verify whether any deployed Linux kernels fall within the affected ranges listed by NVD: 5.19 through 6.1.79, 6.2 through 6.6.15, 6.7 through 6.7.3, and 6.8-rc1.
• Prioritize remediation on systems that run NFSv4 services and accept lock-management traffic from clients.
• If patching must be delayed, reduce exposure to trusted clients only and review operational reliance on NFS lock-owner workflows until the fix is deployed.

Evidence notes

All statements are based on the supplied CVE/NVD corpus and linked official references. The record shows CVE publishedAt 2024-03-13T14:15:07.717Z and modifiedAt 2026-05-12T12:16:18.813Z; those timestamps are used only as record timing context, not as issue-date substitutes. NVD provides CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), CWE-667, and vulnerable CPE ranges. No KEV listing or ransomware-use evidence is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.