EUVD-2026-59462
GHSA-5v8r-fj78-ffg6
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable NLM with no auth (AV:N/PR:N), but triggering depends on residual buffer state (AC:H); no attacker-readable data (C:N), only lock-state correctness/availability harm (I:L/A:L).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pc_argzero to zero for the converted procedures and moved file-handle population into nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes into lock->fh.data.
When an NLMv4 client presents a file handle shorter than LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlm_lookup_file() misses the existing nlm_file entry, and lock-state lookups fail.
Zero only the tail bytes that file_hash() would otherwise consume. Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte that file_hash() reads.
AnalysisAI
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target run a Linux kernel containing commit 3de744ee4e45 with the in-kernel lockd/NLMv4 service enabled and NFS exports reachable by the attacker, and requires the attacker to act as an NLM client sending a file handle strictly shorter than LOCKD_FH_HASH_SIZE (32 bytes) - handles of 32 bytes or more are unaffected because they fully populate the hashed region. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is an automated, boilerplate maximum that is not supported by the technical description and should be treated as inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An NLMv4 client on the network sends a lock request (e.g., TEST/LOCK) carrying an NFS file handle shorter than 32 bytes to a vulnerable lockd server; the trailing uninitialized handle bytes vary with whatever the previous request left in the buffer, so repeated operations on the same file hash to different buckets and the server fails to find the existing lock record. The realistic outcome is broken or inconsistent advisory locking (stale/duplicate lock state) rather than code execution or data theft. … |
| Remediation | Apply the upstream stable fix that zeroes the tail bytes of lock->fh.data before hashing: Patch available per vendor advisory, present in the patched stable builds (referenced as 7.1.5 and 7.2-rc1) via commits 686c2434f9f16b87aeed18d76cc562df9f2695ab and 6e4c62caecf792e8a15ad9bc7f371e57c17e3302 (https://git.kernel.org/stable/c/686c2434f9f16b87aeed18d76cc562df9f2695ab). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all NFS servers running the affected Linux kernel (versions containing commit 3de744ee4e45 or earlier) and monitor for intermittent lock-state lookup failures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today