CVE-2026-89484

A flaw was found in the Linux kernel's lockd component. This vulnerability occurs when the Network Lock Manager (NLM) client attempts to initialize file lock operations without successfully allocating a lockowner. This can lead to a NULL pointer dereference during the release of the file lock, resulting in a system crash. An attacker could potentially exploit this to cause a denial of service.

A low impact flaw was found in the Linux kernel's lockd (Network Lock Manager, NLM) client. When an NLM lockowner allocation fails, nlmclnt_locks_init_private() leaves NLM file lock operations installed on a partially initialized file lock; when the VFS then releases that lock, nlmclnt_locks_release_private() dereferences the missing owner, causing a NULL pointer dereference that crashes the kernel and results in a denial of service. The Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects that exploitation requires local access with low privileges and that only system availability is impacted. Red Hat Enterprise Linux 6, 7, and 8 (including the Real Time kernel and ELS streams) are not affected because the vulnerable code is not present in those releases, and OpenShift Container Platform 4.12 shipping RHEL CoreOS 8 is likewise not affected. The flaw affects Red Hat Enterprise Linux 9 and OpenShift Container Platform releases that ship RHEL CoreOS 9. Fixes for the affected products are deferred because the CVSS score is below 7.0, below the threshold at which Red Hat files trackers for flaws of this severity; the residual risk is a kernel panic in the NLM file locking path, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.