CVE-2026-72472 - Vulnerability Details

- nfs: use nfsi->rwsem to protect traversal of the file lock list

Description

In the Linux kernel, the following vulnerability has been resolved:

nfs: use nfsi->rwsem to protect traversal of the file lock list

Lingfeng identified a bug and suggested two solutions, but both appear
to have issues.

Generally, we cannot release flc_lock while iterating over the file lock
list to avoid use-after-free (UAF) problems with file locks. However,
functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot
adhere to this rule because recover_lock or nfs4_lock_delegation_recall
may take a long time. To resolve this, NFS switches to using nfsi->rwsem
for the same protection, and nfs_reclaim_locks follows this approach.
Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead,
this is inadequate since a single inode can have multiple nfs4_state
instances. Therefore, the fix is to also use nfsi->rwsem in this case.

Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range
lock must be atomic with the stateid update"), the functions
nfs4_locku_done and nfs4_lock_done also break this rule because they
call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding
this protection could cause many deadlocks, so instead, the call to
locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug
fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range
lock must be atomic with the stateid update"), it has been resolved
after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering
state recovery") because all slots are drained before calling
nfs4_do_reclaim, which prevents concurrent stateid changes along this path.
Also, nfs_delegation_claim_locks does not cause this concurrency either
since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is
sent, so nfs4_lock_done is not called. Therefore,
nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first
time the stateid is set.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw stems from the Linux kernel’s NFS implementation, where traversal of the file lock list omitted proper synchronization, representing a use‑after‑free weakness. This omission can trigger a use‑after‑free scenario that corrupts kernel memory, potentially leading to kernel data corruption, privilege escalation, or denial of service when certain lock or delegation recovery operations are performed.

Affected Systems

All Linux kernel distributions that have not applied the patch commits c69899a17ca4 or 0460253913e5 remain vulnerable. The advisory does not enumerate specific kernel releases, so any kernel version preceding those commits remains at risk.

Risk and Exploitability

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating it has not been widely exploited to date. The CVSS score of 9.8 highlights a critical severity. The likely attack vector involves malicious or crafted NFS client requests that exercise the affected lock handling code.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c69899a17ca4836230720e65493942d9582a0424`	affected	< 1cda95bf2e9c0e6b63545b7565fe4a1e474322f4
`c69899a17ca4836230720e65493942d9582a0424`	affected	< f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218
`c69899a17ca4836230720e65493942d9582a0424`	affected	< e68035178e65e2b3aa386ce61202ff33724ae418
`c69899a17ca4836230720e65493942d9582a0424`	affected	< 4837fb36219e6c08b666bc31a86841bad8526358

Linux

affected

Version	Status	Constraints
`4.0`	affected	—
`0`	unaffected	< 4.0
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c69899a17ca4836230720e65493942d9582a0424,1cda95bf2e9c0e6b63545b7565fe4a1e474322f4)`	affected	code_commit	—
`[c69899a17ca4836230720e65493942d9582a0424,f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218)`	affected	code_commit	—
`[c69899a17ca4836230720e65493942d9582a0424,e68035178e65e2b3aa386ce61202ff33724ae418)`	affected	code_commit	—
`[c69899a17ca4836230720e65493942d9582a0424,4837fb36219e6c08b666bc31a86841bad8526358)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.0`	affected	semver	—
`[0,4.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the commits c69899a17ca4 or 0460253913e5 to replace the vulnerable NFS lock handling logic
Disable or limit NFS services on the host until the kernel update is applied
Implement network segmentation or firewall rules to restrict NFS traffic to trusted clients only

Generated by OpenCVE AI on August 18, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00644.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4
https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358
https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418
https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218
https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72472-8c5c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72472
https://www.cve.org/CVERecord?id=CVE-2026-72472

History

Tue, 18 Aug 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72472-8c5c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72472 https://www.cve.org/CVERecord?id=CVE-2026-72472
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.
Title		nfs: use nfsi->rwsem to protect traversal of the file lock list
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4 https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358 https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418 https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:13.752Z

Updated: 2026-08-17T05:44:37.293Z

Reserved: 2026-08-09T03:40:39.934Z

Link: CVE-2026-72472

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:21.313

Modified: 2026-08-17T06:19:15.137

Link: CVE-2026-72472

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72472 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:30:06Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object