In the Linux kernel lockd subsystem, a flaw in the handling of nlm_do_fopen() allows a reference count to be leaked. When a cached file lookup fails, the kernel still increments the file’s reference counter and later fails to decrement it, permanently increasing the refcount. This leaked reference prevents the file from being reclaimed and can cause the lockd file table to grow indefinitely. If an attacker can repeatedly trigger these failed lookups, the table will eventually exhaust kernel memory or render the Network Lock Manager unusable, resulting in a denial-of-service. The vulnerability is a classic example of improper resource reclamation combined with a live lock table that does not shrink (CWE-772).

The vulnerability applies to all Linux kernel releases that contain the legacy nlm_do_fopen implementation used by lockd. An unpatched kernel that implements this subsystem, regardless of distribution or patch level, is affected. The CNA lists the vendor as Linux with no specific version constraints provided, so any machine running a standard Linux distribution whose kernel contains the vulnerable code is at risk.

The CVSS score is 7.0, indicating a high impact. The EPSS score is reported as < 1%, which denotes a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Explotation would require an attacker to invoke repeated nlm_do_fopen failures, which generally implies local kernel privilege or another vulnerability that can trigger the lockd paths. While direct exploitation is considered unlikely, the potential for resource exhaustion can lead to a denial-of-service if the attacker succeeds. The likely attack vector is not explicitly detailed in the description, but it can be inferred that an attacker needs to induce these failures, potentially via crafted lock requests or by exploiting an existing authentication bypass.