{"cve":"CVE-2026-89484","nvd":{"published":"2026-09-11T20:19:30.047","modified":"2026-10-21T13:20:06.213","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix NULL dereference on lockowner allocation failure\n\nnlmclnt_locks_init_private() installs NLM file lock operations even when\nnlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()\nthen returns -ENOMEM, but the VFS still tears down the partially\ninitialized file_lock and calls locks_release_private().\n\nThat invokes nlmclnt_locks_release_private(), which dereferences\nfl->fl_u.nfs_fl.owner and crashes because the owner was never installed.\n\nClear fl_ops before attempting to initialize the NLM private state, and\ninstall the NLM lock operations only after a lockowner has been allocated\nsuccessfully.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/07adfbb3de7529f58ca708a97ead7fa4fdb71056","https://git.kernel.org/stable/c/4c7fc129db061c7daab841c4f3c342d894832362","https://git.kernel.org/stable/c/51af080ca4e553256c59a75a877b9b4fff828311","https://git.kernel.org/stable/c/6db5af172ccc3223c8f730a9a4212f6427feee3e","https://git.kernel.org/stable/c/d662f7fc04fde305a27f304b3cd19b614d366839"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-89484","score":0.00206,"percentile":0.1056,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}