CVE-2026-72218

A flaw was found in the Linux kernel's lockd component. A reference count leak occurs when nlm_do_fopen() fails on a cached file path. This prevents the file's reference count from returning to zero, causing a resource leak. Over time, this can lead to resource exhaustion and a Denial of Service (DoS) condition.

This vulnerability is rated as having a Moderate impact because triggering the flaw requires repeated failed open attempts against cached files within the kernel's Network Lock Manager, resulting in gradual resource consumption rather than immediate system crashes, code execution, or privilege escalation. The issue specifically affects deployments actively serving or mounting legacy NFSv3 shares that utilize lockd for distributed file locking, whereas modern NFSv4 environments do not utilize this subsystem. Red Hat Enterprise Linux 8 and earlier releases do not contain the affected code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.