CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved:

lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile()

filehash() digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pcargzero to zero for the converted procedures and moved file-handle population into nlm4svclookupfile(), which copies only xdrlock->fh.len bytes into lock->fh.data.

When an NLMv4 client presents a file handle shorter than LOCKDFHHASHSIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlmlookupfile() misses the existing nlmfile entry, and lock-state lookups fail.

Zero only the tail bytes that filehash() would otherwise consume. Handles of LOCKDFHHASHSIZE or larger already populate every byte that file_hash() reads.