CVE-2026-89484

lockd: fix NULL dereference on lockowner allocation failure

Published Sep 11, 2026 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

lockd: fix NULL dereference on lockowner allocation failure

nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().

That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.

Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.

Analysis

Technical impact

A NULL pointer dereference occurs in the Linux kernel's NFS client lock subsystem when the allocation of a lockowner fails during nlmclnt_locks_init_private. The failure to install the lockowner initialized file_lock, causing nlmclnt_locks_release_private to dereference fl->fl_u.nfs_fl.owner, which was never set. This kernel crash produces a denial‑of‑service by bringing the system offline.

Affected Systems

Any Linux system that is running a kernel version containing the vulnerable lockd code is affected. The vulnerability exists until the patch commit that cleared the lock operations on allocation failure is applied. Systems with updated kernels that include the fix are not vulnerable.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1% reflects a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by a failed memory allocation in the NFS client lock code, so the likely attack vector is local or requires an NFS client that can force such failures, as inferred from the kernel context. Due to the kernel‑level nature of the fault, exploitation would need such a trigger, making the overall risk moderate.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b61053a3795c2913a7af3ab6218acfdaf52fcafe
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6db5af172ccc3223c8f730a9a4212f6427feee3e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 07adfbb3de7529f58ca708a97ead7fa4fdb71056
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d662f7fc04fde305a27f304b3cd19b614d366839
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 51af080ca4e553256c59a75a877b9b4fff828311
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4c7fc129db061c7daab841c4f3c342d894832362

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,07adfbb3de7529f58ca708a97ead7fa4fdb71056)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d662f7fc04fde305a27f304b3cd19b614d366839)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,51af080ca4e553256c59a75a877b9b4fff828311)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4c7fc129db061c7daab841c4f3c342d894832362)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a release that contains the patch commit (e.g., 07adfbb3...),
If a kernel update is unavailable, configure NFS mounts to use the 'nolock' option so that the NLM lock code path is bypassed during file locking.
Monitor system logs for kernel panic or NULL dereference messages and apply an updated kernel as soon as one becomes available.

Generated by OpenCVE AI on September 15, 2026 at 22:44 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.212% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056
https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362
https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311
https://git.kernel.org/stable/c/6db5af172ccc3223c8f730a9a4212f6427feee3e
https://git.kernel.org/stable/c/b61053a3795c2913a7af3ab6218acfdaf52fcafe
https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839
https://nvd.nist.gov/vuln/detail/CVE-2026-89484
https://www.cve.org/CVERecord?id=CVE-2026-89484

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b61053a3795c2913a7af3ab6218acfdaf52fcafe

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6db5af172ccc3223c8f730a9a4212f6427feee3e

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89484 https://www.cve.org/CVERecord?id=CVE-2026-89484
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully.
Title		lockd: fix NULL dereference on lockowner allocation failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056 https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362 https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311 https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839