CVE-2026-72218

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlmfile refcount leak on cached nlmdo_fopen() failure

The cached-file path in nlmlookupfile() reaches the found: label unconditionally, even when nlmdofopen() fails. At that label *result and file->fcount are updated before the error is returned. The wrappers nlm3svclookupfile() and nlm4svclookupfile() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlmfile pointer remains NULL and the cleanup path skips nlmreleasefile(). The fcount increment is never released, and nlmtraverse_files() can no longer reap the file because its refcount never returns to zero between requests.

Short-circuit the cached path so neither *result nor fcount is touched when nlmdofopen() fails on a hashed nlmfile.