CVE-2026-72372

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72372", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.922Z", "datePublished": "2026-08-15T05:56:07.916Z", "dateUpdated": "2026-08-17T05:43:25.401Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:25.401Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lack of locking around modifications of net->cells_dyn_ino\n\nFix the lack of locking around modifications of net->cells_dyn_ino by\ntaking net->cells_lock exclusively. This also requires to cell to be\nremoved from net->cells_dyn_ino in afs_destroy_cell_work() rather than in\nafs_cell_destroy() as the latter runs in RCU cleanup context and sleeping\nlocks cannot be taken there."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local VFS operations on an AFS dynroot mount (getdents/readdir via afs_dynroot_readdir, lookup via afs_dynroot_lookup_cell) and cell create/destroy paths (afs_alloc_cell/afs_destroy_cell_work), not from remote AFS/RxRPC packet handling.\nAC:L - An attacker can reliably win the race by running concurrent threads that repeatedly readdir /afs while creating and expiring cells through lookups or /proc/net/afs/cells writes; syzbot and public PoCs reproduced the slab UAF within minutes without uncontrollable layout dependencies.\nPR:L - Exploitation requires only an unprivileged local user who can access a dynroot mount (typical world-readable /afs on AFS clients) or mount AFS with -o dyn inside a user namespace where CAP_SYS_ADMIN is available; real init-namespace root is not required.\nUI:N - No victim interaction is needed once dynroot is available; the attacker directly issues the readdir and cell-creation syscalls that race unsynchronized idr_alloc_cyclic, idr_remove, and idr_get_next on net->cells_dyn_ino.\nS:U - Impact is confined to kernel memory integrity and privilege boundaries within the host kernel; it does not cross VM, container, or IOMMU security scopes into a different authority.\nC:H - Concurrent idr_remove during afs_dynroot_readdir_cells leaves idr_get_next with a dangling afs_cell pointer, causing slab use-after-free reads of cell->name and cell->state (confirmed by KASAN in afs_dynroot_readdir) and enabling further kernel memory disclosure.\nI:H - IDR tree corruption and use-after-free of afs_cell objects provide attacker-influenced heap corruption primitives that can be developed into arbitrary kernel writes or control-flow hijack, not merely a benign error return.\nA:H - The race causes kernel oops/panic from corrupted IDR traversal or use-after-free during dir_emit; repeated triggering can crash or hang the system, satisfying high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cell.c", "fs/afs/dynroot.c"], "versions": [{"version": "537b0105952578531f748c7fb3ce36ae9a514784", "lessThan": "4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b", "status": "affected", "versionType": "git"}, {"version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "lessThan": "2ffb70a8a01988046bb207b7d0af9358a8337378", "status": "affected", "versionType": "git"}, {"version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "lessThan": "e94f92fd56c553a8bf9421c3289e1b85c7c08857", "status": "affected", "versionType": "git"}, {"version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "lessThan": "55e841836c6f4646490f7b0347192b7a92d431ba", "status": "affected", "versionType": "git"}, {"version": "6.12.97", "lessThan": "6.12.101", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cell.c", "fs/afs/dynroot.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.97", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b"}, {"url": "https://git.kernel.org/stable/c/2ffb70a8a01988046bb207b7d0af9358a8337378"}, {"url": "https://git.kernel.org/stable/c/e94f92fd56c553a8bf9421c3289e1b85c7c08857"}, {"url": "https://git.kernel.org/stable/c/55e841836c6f4646490f7b0347192b7a92d431ba"}], "title": "afs: Fix lack of locking around modifications of net->cells_dyn_ino", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/cell.c", "fs/afs/dynroot.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b", "status": "affected", "version": "537b0105952578531f748c7fb3ce36ae9a514784", "versionType": "git"}, {"lessThan": "2ffb70a8a01988046bb207b7d0af9358a8337378", "status": "affected", "version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "versionType": "git"}, {"lessThan": "e94f92fd56c553a8bf9421c3289e1b85c7c08857", "status": "affected", "version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "versionType": "git"}, {"lessThan": "55e841836c6f4646490f7b0347192b7a92d431ba", "status": "affected", "version": "1d0b929fc070b4115403a0a6206a0c6a62dd61f5", "versionType": "git"}, {"lessThan": "6.12.101", "status": "affected", "version": "6.12.97", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/cell.c", "fs/afs/dynroot.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lack of locking around modifications of net->cells_dyn_ino\n\nFix the lack of locking around modifications of net->cells_dyn_ino by\ntaking net->cells_lock exclusively. This also requires to cell to be\nremoved from net->cells_dyn_ino in afs_destroy_cell_work() rather than in\nafs_cell_destroy() as the latter runs in RCU cleanup context and sleeping\nlocks cannot be taken there."}], "id": "CVE-2026-72372", "lastModified": "2026-08-17T06:18:41.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:10.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ffb70a8a01988046bb207b7d0af9358a8337378"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/55e841836c6f4646490f7b0347192b7a92d431ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e94f92fd56c553a8bf9421c3289e1b85c7c08857"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: Fix lack of locking around modifications of net->cells_dyn_ino", "id": "2516636", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516636"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nafs: Fix lack of locking around modifications of net->cells_dyn_ino\nFix the lack of locking around modifications of net->cells_dyn_ino by\ntaking net->cells_lock exclusively. This also requires to cell to be\nremoved from net->cells_dyn_ino in afs_destroy_cell_work() rather than in\nafs_cell_destroy() as the latter runs in RCU cleanup context and sleeping\nlocks cannot be taken there.", "A flaw was found in the AFS (Andrew File System) component of the Linux kernel. This vulnerability arises from insufficient locking mechanisms when modifying internal data structures related to dynamic inode management. An attacker could potentially exploit this weakness, leading to system instability or a denial of service (DoS), where the system becomes unresponsive or crashes. The issue has been resolved by implementing exclusive locking during these critical operations."], "name": "CVE-2026-72372", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72372\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72372\nhttps://lore.kernel.org/linux-cve-announce/2026081516-CVE-2026-72372-ec1e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[537b0105952578531f748c7fb3ce36ae9a514784,4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d0b929fc070b4115403a0a6206a0c6a62dd61f5,2ffb70a8a01988046bb207b7d0af9358a8337378)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d0b929fc070b4115403a0a6206a0c6a62dd61f5,e94f92fd56c553a8bf9421c3289e1b85c7c08857)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d0b929fc070b4115403a0a6206a0c6a62dd61f5,55e841836c6f4646490f7b0347192b7a92d431ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.97,6.12.101)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:45:06.977073+00:00", "updated": "2026-08-22T05:15:03.954888+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-413"]}