CVE-2026-72374

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72374", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.922Z", "datePublished": "2026-08-15T05:56:09.182Z", "dateUpdated": "2026-10-16T18:55:20.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:27.599Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications. Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn't yet been seen, but all currently queued received data is\nconsumed. afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote RxRPC traffic to the kafs cache manager on UDP/TCP port 7001 reaches afs_deliver_cb_init_call_back_state3() and afs_deliver_cb_probe_uuid() via rxrpc incoming-call handling (afs_rx_new_call \u2192 afs_deliver_cm_op_id \u2192 afs_cm_incoming_call \u2192 deliver parsers).\nAC:L - An attacker who controls an established callback RxRPC session can reliably force -EAGAIN by fragmenting CB.InitCallBackState3 or CB.ProbeUuid DATA across multiple packets; no special memory layout, races beyond attacker pacing, or rare victim state is required.\nPR:N - No local Linux account or capabilities on the victim are needed; exploitation is driven by a remote RxRPC peer sending fragmented cache-manager callbacks after the encrypted handshake on the callback socket (minimum RXRPC_SECURITY_ENCRYPT).\nUI:N - No victim user action (mounting AFS, opening files, or clicking anything) is required at exploit time; only an active kafs client with its per-net callback listener is needed as deployment context.\nS:U - Impact is confined to kernel/AFS cache-manager state on the victim host (NULL dereference oops, panic, or callback-protocol disruption) and does not cross VM, IOMMU, or sandbox security boundaries.\nC:N - The -EAGAIN mishandling returns success before UUID unmarshalling, leaving call->request NULL; SRXAFSCB_ProbeUuid passes that pointer to memcmp(), causing a kernel fault without attacker-visible disclosure of victim data.\nI:N - The failure mode is premature parser completion and a NULL-pointer memcmp in SRXAFSCB_ProbeUuid (plus possible premature CM replies on InitCallBackState3); no arbitrary kernel write, heap corruption, or code-execution primitive is demonstrated.\nA:H - Treating -EAGAIN as success queues SRXAFSCB_ProbeUuid while call->request is still NULL, and memcmp() on that pointer causes a kernel oops/panic; a remote peer can retrigger this on demand with fragmented CB.ProbeUuid callbacks."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cmservice.c"], "versions": [{"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "26b737b3769e92493fe94c34620399d93ca231ae", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "09c67a7ded481482155b836c8c7f078a3075f8de", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "239cd337c9d047e7097f5b2ebbb41ddfb8180bc6", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "5a39b145a8fb49f316e7ec1f29ba51d68095c7e4", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "772850871a2e772e26f9d93f1e9ddd413b3eeaa4", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "0acbc09d2aca0432af45cec114f20d55ceafaec4", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "f14dd036fad3d359f26f1282199cec06b3a9362b", "status": "affected", "versionType": "git"}, {"version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "0f36469d7ce98b362934113c550d08bb0c784231", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cmservice.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"}, {"url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"}, {"url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"}, {"url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"}, {"url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"}, {"url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"}, {"url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"}, {"url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"}], "title": "afs: Fix callback service message parsers to pass through -EAGAIN", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:48:10.468561Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:20.697Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:48:10.468561Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:48:11.016Z"}}], "cna": {"title": "afs: Fix callback service message parsers to pass through -EAGAIN", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote RxRPC traffic to the kafs cache manager on UDP/TCP port 7001 reaches afs_deliver_cb_init_call_back_state3() and afs_deliver_cb_probe_uuid() via rxrpc incoming-call handling (afs_rx_new_call \u2192 afs_deliver_cm_op_id \u2192 afs_cm_incoming_call \u2192 deliver parsers).\nAC:L - An attacker who controls an established callback RxRPC session can reliably force -EAGAIN by fragmenting CB.InitCallBackState3 or CB.ProbeUuid DATA across multiple packets; no special memory layout, races beyond attacker pacing, or rare victim state is required.\nPR:N - No local Linux account or capabilities on the victim are needed; exploitation is driven by a remote RxRPC peer sending fragmented cache-manager callbacks after the encrypted handshake on the callback socket (minimum RXRPC_SECURITY_ENCRYPT).\nUI:N - No victim user action (mounting AFS, opening files, or clicking anything) is required at exploit time; only an active kafs client with its per-net callback listener is needed as deployment context.\nS:U - Impact is confined to kernel/AFS cache-manager state on the victim host (NULL dereference oops, panic, or callback-protocol disruption) and does not cross VM, IOMMU, or sandbox security boundaries.\nC:N - The -EAGAIN mishandling returns success before UUID unmarshalling, leaving call->request NULL; SRXAFSCB_ProbeUuid passes that pointer to memcmp(), causing a kernel fault without attacker-visible disclosure of victim data.\nI:N - The failure mode is premature parser completion and a NULL-pointer memcmp in SRXAFSCB_ProbeUuid (plus possible premature CM replies on InitCallBackState3); no arbitrary kernel write, heap corruption, or code-execution primitive is demonstrated.\nA:H - Treating -EAGAIN as success queues SRXAFSCB_ProbeUuid while call->request is still NULL, and memcmp() on that pointer causes a kernel oops/panic; a remote peer can retrigger this on demand with fragmented CB.ProbeUuid callbacks."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "26b737b3769e92493fe94c34620399d93ca231ae", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "09c67a7ded481482155b836c8c7f078a3075f8de", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "239cd337c9d047e7097f5b2ebbb41ddfb8180bc6", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "5a39b145a8fb49f316e7ec1f29ba51d68095c7e4", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "772850871a2e772e26f9d93f1e9ddd413b3eeaa4", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "0acbc09d2aca0432af45cec114f20d55ceafaec4", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "f14dd036fad3d359f26f1282199cec06b3a9362b", "versionType": "git"}, {"status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "lessThan": "0f36469d7ce98b362934113c550d08bb0c784231", "versionType": "git"}], "programFiles": ["fs/afs/cmservice.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/afs/cmservice.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"}, {"url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"}, {"url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"}, {"url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"}, {"url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"}, {"url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"}, {"url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"}, {"url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications. Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn't yet been seen, but all currently queued received data is\nconsumed. afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:27.599Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72374", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:20.697Z", "dateReserved": "2026-08-09T03:40:39.922Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:56:09.182Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/cmservice.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "26b737b3769e92493fe94c34620399d93ca231ae", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "09c67a7ded481482155b836c8c7f078a3075f8de", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "239cd337c9d047e7097f5b2ebbb41ddfb8180bc6", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "5a39b145a8fb49f316e7ec1f29ba51d68095c7e4", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "772850871a2e772e26f9d93f1e9ddd413b3eeaa4", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "0acbc09d2aca0432af45cec114f20d55ceafaec4", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "f14dd036fad3d359f26f1282199cec06b3a9362b", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}, {"lessThan": "0f36469d7ce98b362934113c550d08bb0c784231", "status": "affected", "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/cmservice.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications. Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn't yet been seen, but all currently queued received data is\nconsumed. afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN"}], "id": "CVE-2026-72374", "lastModified": "2026-10-16T19:17:25.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72374", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:48:10.468561Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:10.873", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: Fix callback service message parsers to pass through -EAGAIN", "id": "2516650", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516650"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-393", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nafs: Fix callback service message parsers to pass through -EAGAIN\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications. Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn't yet been seen, but all currently queued received data is\nconsumed. afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\nFix callback service message parsers to pass through -EAGAIN", "A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This improper handling of error conditions could lead to unexpected behavior or resource issues within the AFS client."], "name": "CVE-2026-72374", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72374\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72374\nhttps://lore.kernel.org/linux-cve-announce/2026081516-CVE-2026-72374-ab30@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,26b737b3769e92493fe94c34620399d93ca231ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,09c67a7ded481482155b836c7f078a3075f8de)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,239cd337c9d047e7097f5b2ebbb41ddfb8180bc6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,5a39b145a8fb49f316e7ec1f29ba51d68095c7e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,772850871a2e772e26f9d93f1e9ddd413b3eeaa4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,0acbc09d2aca0432af45cec114f20d55ceafaec4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,f14dd036fad3d359f26f1282199cec06b3a9362b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d001648ec7cf8b21ae9eec8b9ba4a18295adfb14,0f36469d7ce98b362934113c550d08bb0c784231)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T11:30:07.158670+00:00", "updated": "2026-08-22T05:15:03.954262+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-390", "CWE-393"]}