CyberRota Analysis
AI-GeneratedA vulnerability in the Linux kernel allows for a reference count leak in the lockd service when the nlm_do_fopen() function fails, leading to an unintentional increment of the file's reference count. This issue prevents proper cleanup of file references, potentially resulting in resource exhaustion over time. Linux system administrators and developers should prioritize addressing this vulnerability to ensure system stability and prevent potential denial-of-service conditions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.