CVE-2026-89485

Status: UPDATED  |  Advisory ID: CVE-2026-89485

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

lockd: pin next file across nlm_inspect_file lock-drop

nlm_traverse_files() pins the current file with f_count++ across

a mutex_unlock for nlm_inspect_file(), but nothing pins the saved

next pointer. A concurrent nlm_release_file() can kfree the next

file during the unlock window, and the iterator dereferences freed

memory on the next loop step.

Pin both current and next before the lock-drop. Advance by

swapping the pinned cursors at the end of each iteration so next

is always held alive across the unlock.

Always call nlm_file_release() after dropping the iteration pin,

regardless of whether the file matched the predicate. Use

nlm_file_inuse(), which does a live walk of the inode lock list,

rather than the cached f_locks field, so skipped files that never

ran nlm_inspect_file() are evaluated correctly.

Because every file in a hash bucket is now pinned and released,

files skipped by the is_failover_file predicate that have no

locks, blocks, shares, or external references are deleted during

traversal. The old code never evaluated skipped files for

cleanup. The new behavior is intentional: such files are stale

and should not persist in the table. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References