CVE-2026-89484— lockd: fix NULL dereference on lockowner allocation failure
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： lockd：修复锁拥有者分配失败时的空指针解引用问题 当 未能成功分配 lockowner 时， 仍然会安装 NLM 文件锁操作（fl_ops）。随后 返回 ，但 VFS 仍会拆解（tear down）部分初始化的 ，并调用 。 这会触发 ，该函数会解引用 ，但由于 lockowner 从未被成功安装，导致空指针解引用进而引发崩溃。 修复方案： 在尝试初始化 NLM 私有状态之前，先清除 ；并且只有在 lockowner 成功分配之后，才安装 NLM 锁操作。
Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 07adfbb3de7529f58ca708a97ead7fa4fdb71056 |
affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d662f7fc04fde305a27f304b3cd19b614d366839 |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 51af080ca4e553256c59a75a877b9b4fff828311 |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4c7fc129db061c7daab841c4f3c342d894832362 |
affected | ||
2.6.12 |
affected | ||
< 2.6.12 |
unaffected | ||
6.12.109≤ 6.12.* |
unaffected | ||
6.18.50≤ 6.18.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89484
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
lockd: fix NULL dereference on lockowner allocation failure
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
lockd: fix NULL dereference on lockowner allocation failure
nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().
That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.
Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89484
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89484
请登录查看更多情报信息。
Other References for CVE-2026-89484 (4)
Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total
| CVE-2026-89490 | ocfs2: fix readdir position truncation on 32-bit kernels | |
| CVE-2026-89477 | sctp: fix NULL deref on untransmitted RECONF completion | |
| CVE-2026-89478 | sctp: drop a chunk if its transport was removed | |
| CVE-2026-89479 | sctp: stop processing a packet once its association is deleted | |
| CVE-2026-89480 | nvme-tcp: reject a read that transferred too few bytes | |
| CVE-2026-89482 | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | |
| CVE-2026-89481 | nvme-tcp: fix host memory disclosure on R2T for a read command | |
| CVE-2026-89483 | nvme: zero the discard fallback page | |
| CVE-2026-89485 | lockd: pin next file across nlm_inspect_file lock-drop | |
| CVE-2026-89486 | ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() | |
| CVE-2026-89487 | openvswitch: only skb_tx_error() a packet we are about to drop | |
| CVE-2026-89488 | openvswitch: Fix CT limit teardown use-after-free | |
| CVE-2026-89489 | openrisc: fix arbitrary kernel memory access via or1k_atomic syscall | |
| CVE-2026-89491 | ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() | |
| CVE-2026-89501 | ring-buffer: Hold cpu_buffer::lock when resizing a subbuf | |
| CVE-2026-89498 | orangefs: fix double-free of trailer_buf on readdir copy failure | |
| CVE-2026-89499 | ring-buffer: Stop remote reader update when page swap fails | |
| CVE-2026-89500 | ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page | |
| CVE-2026-89497 | orangefs: skip leading spaces before parsing client debug masks | |
| CVE-2026-89502 | ring-buffer: Free cpu_buffer::free_page with subbuf_order |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
Same vendor: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
V. Comments for CVE-2026-89484
No comments yet