CVE-2026-89484 - Vulnerability Details

- lockd: fix NULL dereference on lockowner allocation failure

Description

In the Linux kernel, the following vulnerability has been resolved:

lockd: fix NULL dereference on lockowner allocation failure

nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().

That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.

Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.

Published: 2026-09-11

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, a NULL dereference occurs during the allocation of a lockowner in nlmclnt_locks_init_private after a failed allocation, and subsequent cleanup dereferences an uninitialized pointer, causing a kernel crash. This fault results in a denial‑of‑service attack that destabilizes the entire system.

Affected Systems

Affected systems include all Linux installations that run a kernel containing the unpatched lock code. Any deployment that has not applied the patch that addresses the library lock allocation failure should be considered vulnerable.

Risk and Exploitability

With a CVSS score of 5.9 the vulnerability has moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability, and it is not listed in the CISA KEV catalog. The bug can be triggered by either a local user with access to the file system or a remote NFS client that can cause the kernel to crash, placing it at moderate risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 07adfbb3de7529f58ca708a97ead7fa4fdb71056
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d662f7fc04fde305a27f304b3cd19b614d366839
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 51af080ca4e553256c59a75a877b9b4fff828311
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4c7fc129db061c7daab841c4f3c342d894832362

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,07adfbb3de7529f58ca708a97ead7fa4fdb71056)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d662f7fc04fde305a27f304b3cd19b614d366839)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,51af080ca4e553256c59a75a877b9b4fff828311)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4c7fc129db061c7daab841c4f3c342d894832362)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to the latest Linux kernel release that includes the fix for CVE-2026-89484.
If a kernel upgrade is not possible immediately, disable NFS client lock support by commenting out or removing lockd configuration directives, preventing the fault from being triggered.
Verify that any loaded nlm kernel modules are removed or that mount options exclude lock support to mitigate the issue.
Monitor system logs for messages like 'NULL dereference' or 'kernel panic' and apply a patch when it becomes available.

Generated by OpenCVE AI on September 13, 2026 at 04:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056
https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362
https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311
https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839
https://nvd.nist.gov/vuln/detail/CVE-2026-89484
https://www.cve.org/CVERecord?id=CVE-2026-89484

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89484 https://www.cve.org/CVERecord?id=CVE-2026-89484
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully.
Title		lockd: fix NULL dereference on lockowner allocation failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056 https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362 https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311 https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:38.740Z

Updated: 2026-09-11T19:43:38.740Z

Reserved: 2026-09-11T19:38:34.712Z

Link: CVE-2026-89484

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:30.047

Modified: 2026-09-11T20:19:30.047

Link: CVE-2026-89484

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:38Z

Links: CVE-2026-89484 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T04:30:08Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object