CVE-2026-72219

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlm_file leak when nlm_do_fopen() fails

A client can repeatedly drive nlm_do_fopen() failures by presenting

file handles that the underlying export rejects. After kzalloc_obj()

succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not

yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps

to out_unlock, which releases nlm_file_mutex and returns without

freeing the allocation, so each failure leaks one nlm_file.

Route the failure through out_free so kfree() runs before the

function returns.