GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72472 (GCVE-0-2026-72472)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
nfs: use nfsi->rwsem to protect traversal of the file lock list
Summary
In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c69899a17ca4836230720e65493942d9582a0424 , < 1cda95bf2e9c0e6b63545b7565fe4a1e474322f4 (git)
Affected: c69899a17ca4836230720e65493942d9582a0424 , < f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218 (git)
Affected: c69899a17ca4836230720e65493942d9582a0424 , < e68035178e65e2b3aa386ce61202ff33724ae418 (git)
Affected: c69899a17ca4836230720e65493942d9582a0424 , < 4837fb36219e6c08b666bc31a86841bad8526358 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.0
Unaffected: 0 , < 4.0 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/nfs4proc.c",
            "include/linux/nfs_xdr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1cda95bf2e9c0e6b63545b7565fe4a1e474322f4",
              "status": "affected",
              "version": "c69899a17ca4836230720e65493942d9582a0424",
              "versionType": "git"
            },
            {
              "lessThan": "f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218",
              "status": "affected",
              "version": "c69899a17ca4836230720e65493942d9582a0424",
              "versionType": "git"
            },
            {
              "lessThan": "e68035178e65e2b3aa386ce61202ff33724ae418",
              "status": "affected",
              "version": "c69899a17ca4836230720e65493942d9582a0424",
              "versionType": "git"
            },
            {
              "lessThan": "4837fb36219e6c08b666bc31a86841bad8526358",
              "status": "affected",
              "version": "c69899a17ca4836230720e65493942d9582a0424",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/nfs4proc.c",
            "include/linux/nfs_xdr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: use nfsi-\u003erwsem to protect traversal of the file lock list\n\nLingfeng identified a bug and suggested two solutions, but both appear\nto have issues.\n\nGenerally, we cannot release flc_lock while iterating over the file lock\nlist to avoid use-after-free (UAF) problems with file locks. However,\nfunctions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot\nadhere to this rule because recover_lock or nfs4_lock_delegation_recall\nmay take a long time. To resolve this, NFS switches to using nfsi-\u003erwsem\nfor the same protection, and nfs_reclaim_locks follows this approach.\nAlthough nfs_delegation_claim_locks uses so_delegreturn_mutex instead,\nthis is inadequate since a single inode can have multiple nfs4_state\ninstances. Therefore, the fix is to also use nfsi-\u003erwsem in this case.\n\nFurthermore, after commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), the functions\nnfs4_locku_done and nfs4_lock_done also break this rule because they\ncall locks_lock_inode_wait without holding nfsi-\u003erwsem. Simply adding\nthis protection could cause many deadlocks, so instead, the call to\nlocks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug\nfixed by commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), it has been resolved\nafter commit 0460253913e5 (\"NFSv4: nfs4_do_open() is incorrectly triggering\nstate recovery\") because all slots are drained before calling\nnfs4_do_reclaim, which prevents concurrent stateid changes along this path.\nAlso, nfs_delegation_claim_locks does not cause this concurrency either\nsince when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is\nsent, so nfs4_lock_done is not called. Therefore,\nnfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first\ntime the stateid is set."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NFSv4 client and is reachable via network-driven OP_CB_RECALL delegation callbacks and async LOCK/LOCKU RPC completions that invoke nfs_delegation_claim_locks, nfs4_lock_done, and nfs4_locku_done, not only via local flock/fcntl syscalls on a mounted export.\nAC:L - Exploitation is a race while walking the inode lock list with flc_lock dropped; an attacker who controls or races concurrent recalls, lock RPC completions, and flock/fcntl operations on the same NFS file can reliably trigger the UAF without uncontrollable layout or rare kernel options.\nPR:N - A malicious or compromised NFS server can send CB_RECALL and lock RPC responses over the established NFSv4 session to drive delegation return and lock-completion paths without any local account, capability, or root privileges on the victim client.\nUI:N - No victim interaction is required during exploitation once an NFSv4 mount with delegations exists; recalls and lock RPC completions are initiated by the server and client protocol handling while applications may already hold ordinary byte-range locks.\nS:U - Exploitation corrupts kernel heap file_lock state in the NFS client on the same host and enables local privilege escalation or denial of service, but does not by itself cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The flaw is a kernel heap use-after-free while iterating struct file_lock list entries; freed lock objects can be reallocated and dereferenced, enabling arbitrary kernel memory disclosure in addition to controlled corruption.\nI:H - UAF on file_lock structures allows attacker-influenced reuse of freed memory and can be leveraged for arbitrary kernel writes, control-flow hijacking, and privilege escalation rather than only a bounded or transient modification.\nA:H - Concurrent lock list corruption can cause kernel oops, panic, or hang during delegation recall, state recovery, or lock RPC completion, and UAF exploitation commonly crashes the system even when used to gain code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:37.293Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218"
        },
        {
          "url": "https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418"
        },
        {
          "url": "https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"
        }
      ],
      "title": "nfs: use nfsi-\u003erwsem to protect traversal of the file lock list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72472",
    "datePublished": "2026-08-15T05:57:13.752Z",
    "dateReserved": "2026-08-09T03:40:39.934Z",
    "dateUpdated": "2026-08-17T05:44:37.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72472",
      "date": "2026-09-11",
      "epss": "0.00644",
      "percentile": "0.48861"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:51:18.000Z",
      "cve": "CVE-2026-72472",
      "id": "msrc_CVE-2026-72472",
      "initial_release_date": "2026-08-23T14:51:18.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfs: use nfsi-\u003erwsem to protect traversal of the file lock list",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72472.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72472\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:21.313\",\"lastModified\":\"2026-08-17T06:19:15.137\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfs: use nfsi-\u003erwsem to protect traversal of the file lock list\\n\\nLingfeng identified a bug and suggested two solutions, but both appear\\nto have issues.\\n\\nGenerally, we cannot release flc_lock while iterating over the file lock\\nlist to avoid use-after-free (UAF) problems with file locks. However,\\nfunctions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot\\nadhere to this rule because recover_lock or nfs4_lock_delegation_recall\\nmay take a long time. To resolve this, NFS switches to using nfsi-\u003erwsem\\nfor the same protection, and nfs_reclaim_locks follows this approach.\\nAlthough nfs_delegation_claim_locks uses so_delegreturn_mutex instead,\\nthis is inadequate since a single inode can have multiple nfs4_state\\ninstances. Therefore, the fix is to also use nfsi-\u003erwsem in this case.\\n\\nFurthermore, after commit c69899a17ca4 (\\\"NFSv4: Update of VFS byte range\\nlock must be atomic with the stateid update\\\"), the functions\\nnfs4_locku_done and nfs4_lock_done also break this rule because they\\ncall locks_lock_inode_wait without holding nfsi-\u003erwsem. Simply adding\\nthis protection could cause many deadlocks, so instead, the call to\\nlocks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug\\nfixed by commit c69899a17ca4 (\\\"NFSv4: Update of VFS byte range\\nlock must be atomic with the stateid update\\\"), it has been resolved\\nafter commit 0460253913e5 (\\\"NFSv4: nfs4_do_open() is incorrectly triggering\\nstate recovery\\\") because all slots are drained before calling\\nnfs4_do_reclaim, which prevents concurrent stateid changes along this path.\\nAlso, nfs_delegation_claim_locks does not cause this concurrency either\\nsince when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is\\nsent, so nfs4_lock_done is not called. Therefore,\\nnfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first\\ntime the stateid is set.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/delegation.c\",\"fs/nfs/nfs4proc.c\",\"include/linux/nfs_xdr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c69899a17ca4836230720e65493942d9582a0424\",\"lessThan\":\"1cda95bf2e9c0e6b63545b7565fe4a1e474322f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c69899a17ca4836230720e65493942d9582a0424\",\"lessThan\":\"f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c69899a17ca4836230720e65493942d9582a0424\",\"lessThan\":\"e68035178e65e2b3aa386ce61202ff33724ae418\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c69899a17ca4836230720e65493942d9582a0424\",\"lessThan\":\"4837fb36219e6c08b666bc31a86841bad8526358\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/delegation.c\",\"fs/nfs/nfs4proc.c\",\"include/linux/nfs_xdr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T16:06:56+00:00",
      "cve": "CVE-2026-72472",
      "id": "CVE-2026-72472",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfs: use nfsi-\u003erwsem to protect traversal of the file lock list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72472.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-27T16:52:13Z",
      "cve": "CVE-2026-72472",
      "id": "CVE-2026-72472",
      "initial_release_date": "2026-08-27T16:52:13Z",
      "product_status:known_affected": "286",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72472",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72472.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.