CVE-2026-72472

A flaw was found in the Network File System (NFS) component of the Linux kernel. Inadequate synchronization during the traversal of the file lock list can lead to a use-after-free (UAF) vulnerability. This occurs when certain functions release file locks prematurely while iterating, potentially allowing a local attacker to cause a denial of service or, in some cases, execute arbitrary code.

A moderate severity use-after-free flaw was found in the NFSv4 file lock handling of the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. During NFSv4 state recovery or delegation recall, functions such as nfs_delegation_claim_locks and nfs4_reclaim_locks release flc_lock while traversing the file lock list because the recovery or delegation recall operations may take a long time. If another path removes or updates a file lock concurrently while that traversal is in progress, the kernel can continue using a freed file_lock object, resulting in a use-after-free. A local user with access to an existing NFSv4 mount who can perform byte-range file locking operations can trigger this race condition to crash the kernel, causing a denial of service; in the worst case kernel memory corruption could have further consequences. All in-support Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS kernel streams listed in the affects are affected, and the fix is currently deferred for those streams. The residual risk of deferring is considered limited because reliable exploitation depends on the precise timing of NFSv4 lock recovery or delegation recall, and the most likely outcome is a local denial of service. Upstream rates this flaw Critical (CVSS 9.8, AV:N/AC:L/PR:N), while Red Hat rates it Moderate (CVSS 5.5, AV:L/AC:L/PR:L) because triggering the issue requires a local process with privileges on the client interacting with file locks on an already mounted NFS share, rather than direct unauthenticated network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.