CVE-2026-72364

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72364", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.921Z", "datePublished": "2026-08-15T05:56:02.722Z", "dateUpdated": "2026-08-17T05:43:18.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:18.766Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix writeback error handling\n\nFix the error handling in writeback_iter() loop. If an error occurs,\nwriteback_iter() needs to be called again with *error set to the error so\nthat it can clean up iteration state. Further, the current folio needs\nunlocking and redirtying."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in client-side netfs writeback reached only via local VFS writeback (do_writepages -> netfs_writepages) on CIFS, 9p, and AFS mounts after local writes/mmaps dirty pagecache; it is not in ksmbd/nfsd or other packet-receive paths.\nAC:L - An attacker can reliably trigger -ENOMEM during writeback by exhausting the 100-entry folio_queue mempool or system memory while dirtying many pages on a netfs mount, then forcing writeback via sync/fsync, close, or reclaim.\nPR:L - Exploitation requires a local process with write access to files on a netfs-backed mount (typical unprivileged CIFS/9p/AFS user); no real-root or init-namespace-only capability is needed beyond normal filesystem permissions.\nUI:N - No victim interaction is required beyond normal background writeback or attacker-initiated sync/memory pressure; exploitation does not depend on a victim opening a file or mounting a share at attack time.\nS:U - Impact is confined to the kernel pagecache and netfs writeback state on the affected host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:N - The flaw mishandles folio locks and dirty state causing data loss or hangs; it does not expose kernel memory, leak pointers, or provide an out-of-bounds or use-after-free read primitive.\nI:H - On -ENOMEM at writeback start the vulnerable path calls netfs_kill_dirty_pages(), which clears dirty folios without uploading them, silently destroying arbitrary unsaved buffered data on network filesystem mounts.\nA:H - Breaking out of the writeback_iter loop on error leaves folios locked and writeback state uncleared, causing indefinite blocking of processes accessing those pages and stalling future writeback on affected files."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/write_issue.c"], "versions": [{"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "fb39ffd3cc5422887fd118668ff45ebfdbc83302", "status": "affected", "versionType": "git"}, {"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "1bb33d959aabcde07d724b5eb9992462e91fa79a", "status": "affected", "versionType": "git"}, {"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "89df9c158a25d0a7c6ca079a9bd9ca7009d75c7b", "status": "affected", "versionType": "git"}, {"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "ac5f95ac5d6d0f4c567b8b642825705a2bf0d79e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/write_issue.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb39ffd3cc5422887fd118668ff45ebfdbc83302"}, {"url": "https://git.kernel.org/stable/c/1bb33d959aabcde07d724b5eb9992462e91fa79a"}, {"url": "https://git.kernel.org/stable/c/89df9c158a25d0a7c6ca079a9bd9ca7009d75c7b"}, {"url": "https://git.kernel.org/stable/c/ac5f95ac5d6d0f4c567b8b642825705a2bf0d79e"}], "title": "netfs: Fix writeback error handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/write_issue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fb39ffd3cc5422887fd118668ff45ebfdbc83302", "status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "versionType": "git"}, {"lessThan": "1bb33d959aabcde07d724b5eb9992462e91fa79a", "status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "versionType": "git"}, {"lessThan": "89df9c158a25d0a7c6ca079a9bd9ca7009d75c7b", "status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "versionType": "git"}, {"lessThan": "ac5f95ac5d6d0f4c567b8b642825705a2bf0d79e", "status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/netfs/write_issue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix writeback error handling\n\nFix the error handling in writeback_iter() loop. If an error occurs,\nwriteback_iter() needs to be called again with *error set to the error so\nthat it can clean up iteration state. Further, the current folio needs\nunlocking and redirtying."}], "id": "CVE-2026-72364", "lastModified": "2026-08-17T06:18:40.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:09.823", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1bb33d959aabcde07d724b5eb9992462e91fa79a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89df9c158a25d0a7c6ca079a9bd9ca7009d75c7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac5f95ac5d6d0f4c567b8b642825705a2bf0d79e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb39ffd3cc5422887fd118668ff45ebfdbc83302"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfs: Fix writeback error handling", "id": "2516661", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516661"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfs: Fix writeback error handling\nFix the error handling in writeback_iter() loop. If an error occurs,\nwriteback_iter() needs to be called again with *error set to the error so\nthat it can clean up iteration state. Further, the current folio needs\nunlocking and redirtying.", "A flaw was found in the `netfs` component of the Linux kernel. This vulnerability arises from improper error handling in the `writeback_iter()` loop. When an error occurs during writeback operations, the system fails to correctly clean up iteration states and manage memory folios. This can lead to resource mismanagement and potential system instability, affecting the reliability of network file system operations."], "name": "CVE-2026-72364", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72364\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72364\nhttps://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72364-9a8a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[288ace2f57c9d06dd2e42bd80d03747d879a4068,fb39ffd3cc5422887fd118668ff45ebfdbc83302)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[288ace2f57c9d06dd2e42bd80d03747d879a4068,1bb33d959aabcde07d724b5eb9992462e91fa79a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[288ace2f57c9d06dd2e42bd80d03747d879a4068,89df9c158a25d0a7c6ca079a9bd9ca7009d75c7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[288ace2f57c9d06dd2e42bd80d03747d879a4068,ac5f95ac5d6d0f4c567b8b642825705a2bf0d79e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T20:00:08.423508+00:00", "updated": "2026-08-22T07:45:17.703447+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}