SB20260925146 - Function Call with Incorrectly Specified Arguments in Linux kernel lockd

Description

This security bulletin contains information about 1 vulnerability.

1) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-93231)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent locks associated with a requested server IP address from being released.

The vulnerability exists due to incorrectly specified arguments in nlmsvc_match_ip() when releasing locks by server IP address through /proc/fs/nfsd/unlock_ip. A local user can invoke the unlock-by-IP operation to prevent locks associated with the requested server IP address from being released.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0d72e78c9d38d5377a059a4837f82b65b91cdcf6
• https://git.kernel.org/stable/c/21bcb609e0ab1dd60f39ca3498f85808933bcc9f
• https://git.kernel.org/stable/c/b9060689f49dc663e9a3d069c4a65ff63a836e66