CVE-2026-74315 - Vulnerability Details

- lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

Description

In the Linux kernel, the following vulnerability has been resolved:

lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of
nfs_fh.data when bucketing nlm_files[], independent of fh.size.
Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the
NLMv4 TEST procedure") set .pc_argzero to zero for the converted
procedures and moved file-handle population into
nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes
into lock->fh.data.

When an NLMv4 client presents a file handle shorter than
LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument
buffer held from an earlier request. The same wire handle then
hashes to different buckets across calls; nlm_lookup_file() misses
the existing nlm_file entry, and lock-state lookups fail.

Zero only the tail bytes that file_hash() would otherwise consume.
Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte
that file_hash() reads.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An inadvertent use of uninitialized memory in the Linux kernel’s lock manager caused NLMv4 file handles that are shorter than the defined hashing size to be hashed inconsistently, leading to lock lookup failures and disruption of NFS lock operations; the core weakness is improper initialization of hashing input, which can result in lock state inconsistencies and potential denial of service for clients reliant on NFS locking.

Affected Systems

All Linux kernel releases that were compiled before the inclusion of commit 3de744ee4e45, which introduced the patch that clears uninitialized tail bytes when hashing file handles, are affected; any deployment that uses the NLMv4 protocol with the lock manager (lockd) enabled without this patch is vulnerable.

Risk and Exploitability

The flaw can be triggered by an NLMv4 client that sends a file handle shorter than LOCKD_FH_HASH_SIZE, causing consistent lock state lookup failures; the EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits are known, though the kernel nature and potential to break NFS lock services make it a significant risk in comparable threat scenarios. The CVSS score of 9.8 indicates critical severity, underscoring the importance of promptly addressing the issue.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3de744ee4e4557da0d63be8a97ad44b4dad58912`	affected	< 686c2434f9f16b87aeed18d76cc562df9f2695ab
`3de744ee4e4557da0d63be8a97ad44b4dad58912`	affected	< 6e4c62caecf792e8a15ad9bc7f371e57c17e3302

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3de744ee4e4557da0d63be8a97ad44b4dad58912,686c2434f9f16b87aeed18d76cc562df9f2695ab)`	affected	code_commit	—
`[3de744ee4e4557da0d63be8a97ad44b4dad58912,6e4c62caecf792e8a15ad9bc7f371e57c17e3302)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes commit 3de744ee4e45 or any later revision that addresses the uninitialized byte hashing issue
If a kernel upgrade cannot be performed immediately, disable the NLMv4 lock manager in the NFS configuration (e.g., edit NFS settings to turn off lockd for the affected shares) to prevent lock lookup errors
Monitor system logs and kernel messages for lock lookup failures and plan a timely kernel update to eliminate the vulnerability

Generated by OpenCVE AI on August 22, 2026 at 00:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0038.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/686c2434f9f16b87aeed18d76cc562df9f2695ab
https://git.kernel.org/stable/c/6e4c62caecf792e8a15ad9bc7f371e57c17e3302
https://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-74315-3f91@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74315
https://www.cve.org/CVERecord?id=CVE-2026-74315

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-74315-3f91@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74315 https://www.cve.org/CVERecord?id=CVE-2026-74315
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pc_argzero to zero for the converted procedures and moved file-handle population into nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes into lock->fh.data. When an NLMv4 client presents a file handle shorter than LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlm_lookup_file() misses the existing nlm_file entry, and lock-state lookups fail. Zero only the tail bytes that file_hash() would otherwise consume. Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte that file_hash() reads.
Title		lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/686c2434f9f16b87aeed18d76cc562df9f2695ab https://git.kernel.org/stable/c/6e4c62caecf792e8a15ad9bc7f371e57c17e3302

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:13.504Z

Updated: 2026-08-17T05:45:48.282Z

Reserved: 2026-08-15T05:44:03.883Z

Link: CVE-2026-74315

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:31.763

Modified: 2026-08-17T06:19:25.867

Link: CVE-2026-74315

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74315 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T00:30:16Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object