{"id":"AZL-100778","summary":"CVE-2026-89484 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix NULL dereference on lockowner allocation failure\n\nnlmclnt_locks_init_private() installs NLM file lock operations even when\nnlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()\nthen returns -ENOMEM, but the VFS still tears down the partially\ninitialized file_lock and calls locks_release_private().\n\nThat invokes nlmclnt_locks_release_private(), which dereferences\nfl-\u003efl_u.nfs_fl.owner and crashes because the owner was never installed.\n\nClear fl_ops before attempting to initialize the NLM private state, and\ninstall the NLM lock operations only after a lockowner has been allocated\nsuccessfully.","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:30Z","upstream":["CVE-2026-89484"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89484"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100778.json"}}],"schema_version":"1.9.0"}