PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72218 Linux CVE debrief

A vulnerability in the Linux kernel has been resolved, related to a reference count leak in the lockd component. Specifically, the cached-file path in nlm_lookup_file() updates *result and file->f_count even when nlm_do_fopen() fails, leading to a reference count leak that can prevent the file from being reaped by nlm_traverse_files(). This issue arises because the cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label, *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. To address this, the fix involves short-circuiting the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. Linux kernel developers and maintainers should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also consider implementing compensating controls to detect and prevent potential exploitation.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems. These parties should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also consider implementing compensating controls to detect and prevent potential exploitation.

Technical summary

The vulnerability is caused by a reference count leak in the lockd component of the Linux kernel. Specifically, the cached-file path in nlm_lookup_file() updates *result and file->f_count even when nlm_do_fopen() fails, leading to a reference count leak that can prevent the file from being reaped by nlm_traverse_files(). The fix involves short-circuiting the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. This issue affects Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the relevant Linux kernel patches to fix the reference count leak in lockd.
  • Monitor Linux kernel updates and ensure that the patched version is deployed.
  • Consider implementing compensating controls to detect and prevent potential exploitation.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and commit history may be necessary to fully understand the issue. The vulnerability is related to a reference count leak in the lockd component of the Linux kernel. The cached-file path in nlm_lookup_file() updates *result and file->f_count even when nlm_do_fopen() fails, leading to a reference count leak that can prevent the file from being reaped by nlm_traverse_files(). The fix involves short-circuiting the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. Linux kernel developers should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also consider implementing compensating controls to detect and prevent potential exploitation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:21:40.613Z and has not been modified since then.