CVE-2026-89485

A flaw was found in the lockd component of the Linux kernel. This use-after-free vulnerability occurs in the nlm_traverse_files() function when a file's memory is prematurely released while an iterator still holds a pointer to it. A remote attacker could potentially exploit this to cause system instability or a denial of service (DoS) by triggering a concurrent file release during a specific unlock window.

A race in lockd nlm_traverse_files can dereference a freed nlm_file object because the iterator pins the current file but not the saved next file while dropping nlm_file_mutex around nlm_inspect_file. A concurrent nlm_release_file can unlink and kfree that next object during the unlock window, leaving the iterator to access freed slab memory on the next loop step. For the CVSS the PR:N is used in the paranoid score because an exposed NFS lockd service may be reachable by a remote client without a local account on the target, although reliable triggering still requires NFS/NLM access and a race window. The issue is network reachable when lockd is exposed to untrusted or semi trusted NFS clients. Impact is at least denial of service via kernel crash, and in the worst case may allow confidentiality or integrity impact due to UAF based memory corruption. NFS and lockd are usually deployed inside trusted storage or data center networks rather than the public Internet, but exposure to untrusted clients should be treated as high risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.