CVE-2026-89484 - Vulnerability Details

- lockd: fix NULL dereference on lockowner allocation failure

Description

In the Linux kernel, the following vulnerability has been resolved:

lockd: fix NULL dereference on lockowner allocation failure

nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().

That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.

Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.

Published: 2026-09-11

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference occurs in the Linux kernel's NFS client lock subsystem when the allocation of a lockowner fails during nlmclnt_locks_init_private. The failure to install the lockowner initialized file_lock, causing nlmclnt_locks_release_private to dereference fl->fl_u.nfs_fl.owner, which was never set. This kernel crash produces a denial‑of‑service by bringing the system offline.

Affected Systems

Any Linux system that is running a kernel version containing the vulnerable lockd code is affected. The vulnerability exists until the patch commit that cleared the lock operations on allocation failure is applied. Systems with updated kernels that include the fix are not vulnerable.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1% reflects a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by a failed memory allocation in the NFS client lock code, so the likely attack vector is local or requires an NFS client that can force such failures, as inferred from the kernel context. Due to the kernel‑level nature of the fault, exploitation would need such a trigger, making the overall risk moderate.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 07adfbb3de7529f58ca708a97ead7fa4fdb71056
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d662f7fc04fde305a27f304b3cd19b614d366839
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 51af080ca4e553256c59a75a877b9b4fff828311
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4c7fc129db061c7daab841c4f3c342d894832362

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,07adfbb3de7529f58ca708a97ead7fa4fdb71056)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d662f7fc04fde305a27f304b3cd19b614d366839)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,51af080ca4e553256c59a75a877b9b4fff828311)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4c7fc129db061c7daab841c4f3c342d894832362)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a release that contains the patch commit (e.g., 07adfbb3...),
If a kernel update is unavailable, configure NFS mounts to use the 'nolock' option so that the NLM lock code path is bypassed during file locking.
Monitor system logs for kernel panic or NULL dereference messages and apply an updated kernel as soon as one becomes available.

Generated by OpenCVE AI on September 15, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056
https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362
https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311
https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839
https://nvd.nist.gov/vuln/detail/CVE-2026-89484
https://www.cve.org/CVERecord?id=CVE-2026-89484

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89484 https://www.cve.org/CVERecord?id=CVE-2026-89484
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully.
Title		lockd: fix NULL dereference on lockowner allocation failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056 https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362 https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311 https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:38.740Z

Updated: 2026-09-11T19:43:38.740Z

Reserved: 2026-09-11T19:38:34.712Z

Link: CVE-2026-89484

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:30.047

Modified: 2026-09-11T20:19:30.047

Link: CVE-2026-89484

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:38Z

Links: CVE-2026-89484 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:45:07Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object