External risk intelligence

Linux Kernel NFS File Lock List Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72472

This vulnerability exists within the Linux kernel's internal NFS (Network File System) implementation, specifically regarding how it handles file lock lists and internal state synchronization. It is a deep-seated operating system component issue rather than an internet-facing application, service, or gateway.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A resolved vulnerability in the Linux kernel's NFS component could allow for unauthorized access and modification of data by disrupting file lock management.

Affects Linux kernel NFS file locking.
Matters for maintaining system integrity and data security.
Confirm relevance and exposure to this kernel issue.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a vulnerability in the Linux kernel's NFS component by triggering a race condition during file lock list traversal. This could occur when operations that require a long time, such as reclaiming locks or handling delegation recalls, are performed concurrently. Successful exploitation might lead to a use-after-free vulnerability, potentially allowing an attacker to gain elevated privileges or crash the system.

Entry condition: Network access to an NFS client.
Trigger point: Concurrent file lock operations.
Resulting risk: Use-after-free, system instability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability, present in the Linux kernel's NFS implementation, could impact the integrity and availability of file operations when specific internal race conditions occur related to file lock management. These conditions may arise during complex file locking scenarios or state recovery processes within the NFS client.

File lock data integrity.
Internal race conditions during NFS operations.
Potential for system instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's NFS implementation requires immediate attention from teams managing Linux systems and NFS services. The first practical step is to identify all systems running the affected kernel version, determine if these systems are exposed externally or host critical business data, and identify the accountable owner for each instance before planning remediation.

Identify system owners and NFS service administrators.
Verify affected kernel and NFS service exposure.
Plan and coordinate kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NFS component affected by CVE-2026-72472?

The Network File System (NFS) is a distributed file system protocol that allows a user on a client computer to access files over a network as if they were on local storage. In the Linux kernel, the NFS component manages the complex tasks of remote file access, including byte-range locking, which ensures that multiple users or processes do not interfere with each other when reading or writing to the same file simultaneously.

What is the root cause of this vulnerability?

The vulnerability involves a memory safety issue known as a use-after-free, which occurs when a system component attempts to use a memory address after it has been released. In this case, the weakness stems from inconsistent protection of the file lock list during traversals in the NFS client. Because some operations hold locks longer than others, the system was prone to race conditions where the data being accessed was unexpectedly freed or modified, potentially leading to instability.

How can this vulnerability be triggered?

This flaw is triggered by specific, complex interactions involving concurrent file locking operations. It requires a scenario where an attacker can influence or wait for file lock state recovery, such as reclaiming locks or delegation recalls, to occur simultaneously. It is not triggered by simple, routine read/write operations; the bug is tied to the specific timing and synchronization of internal kernel processes that manage the file locking state.

Is my system at risk for CVE-2026-72472?

While the vulnerability involves network-related code, Halo Surface Signal notes it is very unlikely to be exploited from the internet. The issue exists deep within the Linux kernel's internal NFS state synchronization logic. It is not a typical internet-facing service bug, but rather an issue that impacts how the kernel manages local memory during remote file operations. You should focus your investigation on Linux systems utilizing NFS for critical file sharing.

What should I do first to address this issue?

Start by identifying all Linux systems in your environment that utilize NFS for file storage. Once you have a list of these servers, confirm their specific kernel versions to see if they align with the affected releases. Coordinate with your system administrators to review the security update history and prioritize patching any systems that host highly sensitive or critical data, as the focus is on maintaining overall system integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.