CVE-2026-74315

You are dealing with CVE-2026-74315, a partial-initialization vulnerability in the Linux kernel's lockd subsystem. Here's what matters for your assessment and response. The core issue: nlm4svc_lookup_file() copies only xdr_lock->fh.len bytes during XDR deserialization, but file_hash() unconditionally hashes the full LOCKD_FH_HASH_SIZE buffer. This creates a situation where uninitialized tail bytes in the file handle structure influence hash bucket selection. The same logical file can map to different hash buckets depending on whatever garbage happens to be in memory—exactly the condition that enables both denial of lock-state lookups and potential information disclosure across unrelated requests. The fix zeros only the tail bytes beyond fh.len at usage time, a targeted intervention that sidesteps the question of why commit 3de744ee4e45 didn't zero those bytes in the first place. That original commit was an explicit optimization tradeoff, not an accidental omission—it moved handle population into a code path that assumed argument buffers would carry over previous contents safely. The patch re-introduces selective zeroing to correct that assumption post-hoc. Two questions deserve scrutiny in your environment. First, verify whether .pc_argzero (the procedure entry zeroing mechanism) actually provides the guarantee the fix implicitly relies on—if argzero happens before XDR population, the fix is redundant for new requests, which suggests either argzero isn't being applied correctly or error paths bypass the guarantee. Second, audit other lockd XDR conversion procedures: this was one conversion batch, and the underlying tension between variable-length wire handles and fixed-width internal structures is systemic, not isolated. The CVSS 9.8 rating warrants your own judgment. The demonstrated impact is lock-state lookup failures (service degradation), not confirmed memory disclosure. The theoretical reach through hash-collision side-channels exists but depends on attacker control over scheduling and uninitialized memory state—conditions that may not be achievable in practice. Score the issue based on your exploitability assessment, not the headline number.

Reviewed through automated stages and approved by a human before publication.