CVE-2026-74315

A flaw was found in the lockd component of the Linux kernel. A remote attacker can exploit this vulnerability by presenting a Network Lock Manager version 4 (NLMv4) file handle shorter than expected. This causes the system to hash uninitialized bytes, leading to inconsistent file handle lookups. Consequently, existing lock-state entries are missed, resulting in a Denial of Service (DoS) for NLM operations.

NFS lockd can hash uninitialized tail bytes when an NLMv4 client sends a file handle shorter than LOCKD_FH_HASH_SIZE. The same wire file handle can then map to different nlm_file buckets across requests, causing nlm_lookup_file to miss existing lock state and making NLM lock enforcement unreliable for affected files. For the CVSS the PR:N is used because the trigger is a network protocol request to lockd and does not require a local user account on the target, although real deployments usually restrict NFS and lockd access to trusted storage networks or exported clients. The issue is network reachable but the attack complexity is high because reliable impact depends on short file handles and on the residual argument buffer contents from earlier requests. Impact is limited integrity and availability for network lock state correctness. There is no clear evidence of memory corruption, information disclosure, kernel crash, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.