CVE-2026-72218 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
A refcount leak in the Linux kernel lockd module allows remote attackers to cause a denial of service by exhausting file resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72218?
CVE-2026-72218 is a denial of service vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests.
Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.
Which versions are affected by CVE-2026-72218?
How do I fix CVE-2026-72218?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72218 being exploited?
There is no known exploitation of CVE-2026-72218 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72218, DEBIAN-CVE-2026-72218, GHSA-mwwg-vq2v-v2c8, UBUNTU-CVE-2026-72218.