{"apiVersion":"1.0","identifier":"CVE-2026-72472","description":"In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 (-NFSv4: Update of VFS byte range lock must be atomic with the stateid update-), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 (-NFSv4: Update of VFS byte range lock must be atomic with the stateid update-), it has been resolved after commit 0460253913e5 (-NFSv4: nfs4_do_open() is incorrectly triggering state recovery-) because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.","publishedAt":"2026-08-15T06:22:21","lastModifiedAt":"2026-08-17T06:19:15","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72472","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00644,"riskScore":1.04,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72472","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72472","en":"https://www.redsauce.net/en/cves/CVE-2026-72472","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72472","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72472","de":"https://www.redsauce.net/de/cves/CVE-2026-72472","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72472","el":"https://www.redsauce.net/el/cves/CVE-2026-72472"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72472"}}