CVE-2026-72219 lockd: Plug nlm_file leak when nlm_do_fopen() fails
A remote attacker can cause a memory leak in the Linux kernel lockd module by triggering file open failures, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72219?
CVE-2026-72219 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
lockd: Plug nlm_file leak when nlm_do_fopen() fails
A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file.
Route the failure through out_free so kfree() runs before the function returns.
Which versions are affected by CVE-2026-72219?
How do I fix CVE-2026-72219?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72219 being exploited?
There is no known exploitation of CVE-2026-72219 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72219, DEBIAN-CVE-2026-72219, GHSA-m2jh-wwh7-6pvf, UBUNTU-CVE-2026-72219.