CVE-2026-89485

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

lockd: pin next file across nlm_inspect_file lock-drop

nlm_traverse_files() pins the current file with f_count++ across

a mutex_unlock for nlm_inspect_file(), but nothing pins the saved

next pointer. A concurrent nlm_release_file() can kfree the next

file during the unlock window, and the iterator dereferences freed

memory on the next loop step.

Pin both current and next before the lock-drop. Advance by

swapping the pinned cursors at the end of each iteration so next

is always held alive across the unlock.

Always call nlm_file_release() after dropping the iteration pin,

regardless of whether the file matched the predicate. Use

nlm_file_inuse(), which does a live walk of the inode lock list,

rather than the cached f_locks field, so skipped files that never

ran nlm_inspect_file() are evaluated correctly.

Because every file in a hash bucket is now pinned and released,

files skipped by the is_failover_file predicat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References