CVE-2026-72472

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72472", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.934Z", "datePublished": "2026-08-15T05:57:13.752Z", "dateUpdated": "2026-10-30T12:29:29.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:29:29.497Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: use nfsi->rwsem to protect traversal of the file lock list\n\nLingfeng identified a bug and suggested two solutions, but both appear\nto have issues.\n\nGenerally, we cannot release flc_lock while iterating over the file lock\nlist to avoid use-after-free (UAF) problems with file locks. However,\nfunctions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot\nadhere to this rule because recover_lock or nfs4_lock_delegation_recall\nmay take a long time. To resolve this, NFS switches to using nfsi->rwsem\nfor the same protection, and nfs_reclaim_locks follows this approach.\nAlthough nfs_delegation_claim_locks uses so_delegreturn_mutex instead,\nthis is inadequate since a single inode can have multiple nfs4_state\ninstances. Therefore, the fix is to also use nfsi->rwsem in this case.\n\nFurthermore, after commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), the functions\nnfs4_locku_done and nfs4_lock_done also break this rule because they\ncall locks_lock_inode_wait without holding nfsi->rwsem. Simply adding\nthis protection could cause many deadlocks, so instead, the call to\nlocks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug\nfixed by commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), it has been resolved\nafter commit 0460253913e5 (\"NFSv4: nfs4_do_open() is incorrectly triggering\nstate recovery\") because all slots are drained before calling\nnfs4_do_reclaim, which prevents concurrent stateid changes along this path.\nAlso, nfs_delegation_claim_locks does not cause this concurrency either\nsince when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is\nsent, so nfs4_lock_done is not called. Therefore,\nnfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first\ntime the stateid is set."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the NFSv4 client and is reachable via network-driven OP_CB_RECALL delegation callbacks and async LOCK/LOCKU RPC completions that invoke nfs_delegation_claim_locks, nfs4_lock_done, and nfs4_locku_done, not only via local flock/fcntl syscalls on a mounted export.\nAC:L - Exploitation is a race while walking the inode lock list with flc_lock dropped; an attacker who controls or races concurrent recalls, lock RPC completions, and flock/fcntl operations on the same NFS file can reliably trigger the UAF without uncontrollable layout or rare kernel options.\nPR:N - A malicious or compromised NFS server can send CB_RECALL and lock RPC responses over the established NFSv4 session to drive delegation return and lock-completion paths without any local account, capability, or root privileges on the victim client.\nUI:N - No victim interaction is required during exploitation once an NFSv4 mount with delegations exists; recalls and lock RPC completions are initiated by the server and client protocol handling while applications may already hold ordinary byte-range locks.\nS:U - Exploitation corrupts kernel heap file_lock state in the NFS client on the same host and enables local privilege escalation or denial of service, but does not by itself cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The flaw is a kernel heap use-after-free while iterating struct file_lock list entries; freed lock objects can be reallocated and dereferenced, enabling arbitrary kernel memory disclosure in addition to controlled corruption.\nI:H - UAF on file_lock structures allows attacker-influenced reuse of freed memory and can be leveraged for arbitrary kernel writes, control-flow hijacking, and privilege escalation rather than only a bounded or transient modification.\nA:H - Concurrent lock list corruption can cause kernel oops, panic, or hang during delegation recall, state recovery, or lock RPC completion, and UAF exploitation commonly crashes the system even when used to gain code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "versions": [{"version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "7813adb38c88573b730219c1dc1b630dfab7165e", "status": "affected", "versionType": "git"}, {"version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "1cda95bf2e9c0e6b63545b7565fe4a1e474322f4", "status": "affected", "versionType": "git"}, {"version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218", "status": "affected", "versionType": "git"}, {"version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "e68035178e65e2b3aa386ce61202ff33724ae418", "status": "affected", "versionType": "git"}, {"version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "4837fb36219e6c08b666bc31a86841bad8526358", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "versions": [{"version": "4.0", "status": "affected"}, {"version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7813adb38c88573b730219c1dc1b630dfab7165e"}, {"url": "https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4"}, {"url": "https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218"}, {"url": "https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418"}, {"url": "https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}], "title": "nfs: use nfsi->rwsem to protect traversal of the file lock list", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:50:31.105592Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:25.590Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:50:31.105592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:50:31.656Z"}}], "cna": {"title": "nfs: use nfsi->rwsem to protect traversal of the file lock list", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the NFSv4 client and is reachable via network-driven OP_CB_RECALL delegation callbacks and async LOCK/LOCKU RPC completions that invoke nfs_delegation_claim_locks, nfs4_lock_done, and nfs4_locku_done, not only via local flock/fcntl syscalls on a mounted export.\nAC:L - Exploitation is a race while walking the inode lock list with flc_lock dropped; an attacker who controls or races concurrent recalls, lock RPC completions, and flock/fcntl operations on the same NFS file can reliably trigger the UAF without uncontrollable layout or rare kernel options.\nPR:N - A malicious or compromised NFS server can send CB_RECALL and lock RPC responses over the established NFSv4 session to drive delegation return and lock-completion paths without any local account, capability, or root privileges on the victim client.\nUI:N - No victim interaction is required during exploitation once an NFSv4 mount with delegations exists; recalls and lock RPC completions are initiated by the server and client protocol handling while applications may already hold ordinary byte-range locks.\nS:U - Exploitation corrupts kernel heap file_lock state in the NFS client on the same host and enables local privilege escalation or denial of service, but does not by itself cross a VM, container, or IOMMU security boundary to another authority.\nC:H - The flaw is a kernel heap use-after-free while iterating struct file_lock list entries; freed lock objects can be reallocated and dereferenced, enabling arbitrary kernel memory disclosure in addition to controlled corruption.\nI:H - UAF on file_lock structures allows attacker-influenced reuse of freed memory and can be leveraged for arbitrary kernel writes, control-flow hijacking, and privilege escalation rather than only a bounded or transient modification.\nA:H - Concurrent lock list corruption can cause kernel oops, panic, or hang during delegation recall, state recovery, or lock RPC completion, and UAF exploitation commonly crashes the system even when used to gain code execution."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "7813adb38c88573b730219c1dc1b630dfab7165e", "versionType": "git"}, {"status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "1cda95bf2e9c0e6b63545b7565fe4a1e474322f4", "versionType": "git"}, {"status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218", "versionType": "git"}, {"status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "e68035178e65e2b3aa386ce61202ff33724ae418", "versionType": "git"}, {"status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "lessThan": "4837fb36219e6c08b666bc31a86841bad8526358", "versionType": "git"}], "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"status": "unaffected", "version": "0", "lessThan": "4.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7813adb38c88573b730219c1dc1b630dfab7165e"}, {"url": "https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4"}, {"url": "https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218"}, {"url": "https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418"}, {"url": "https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: use nfsi->rwsem to protect traversal of the file lock list\n\nLingfeng identified a bug and suggested two solutions, but both appear\nto have issues.\n\nGenerally, we cannot release flc_lock while iterating over the file lock\nlist to avoid use-after-free (UAF) problems with file locks. However,\nfunctions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot\nadhere to this rule because recover_lock or nfs4_lock_delegation_recall\nmay take a long time. To resolve this, NFS switches to using nfsi->rwsem\nfor the same protection, and nfs_reclaim_locks follows this approach.\nAlthough nfs_delegation_claim_locks uses so_delegreturn_mutex instead,\nthis is inadequate since a single inode can have multiple nfs4_state\ninstances. Therefore, the fix is to also use nfsi->rwsem in this case.\n\nFurthermore, after commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), the functions\nnfs4_locku_done and nfs4_lock_done also break this rule because they\ncall locks_lock_inode_wait without holding nfsi->rwsem. Simply adding\nthis protection could cause many deadlocks, so instead, the call to\nlocks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug\nfixed by commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), it has been resolved\nafter commit 0460253913e5 (\"NFSv4: nfs4_do_open() is incorrectly triggering\nstate recovery\") because all slots are drained before calling\nnfs4_do_reclaim, which prevents concurrent stateid changes along this path.\nAlso, nfs_delegation_claim_locks does not cause this concurrency either\nsince when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is\nsent, so nfs4_lock_done is not called. Therefore,\nnfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first\ntime the stateid is set."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:29:29.497Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72472", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:29:29.497Z", "dateReserved": "2026-08-09T03:40:39.934Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:13.752Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7813adb38c88573b730219c1dc1b630dfab7165e", "status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "versionType": "git"}, {"lessThan": "1cda95bf2e9c0e6b63545b7565fe4a1e474322f4", "status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "versionType": "git"}, {"lessThan": "f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218", "status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "versionType": "git"}, {"lessThan": "e68035178e65e2b3aa386ce61202ff33724ae418", "status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "versionType": "git"}, {"lessThan": "4837fb36219e6c08b666bc31a86841bad8526358", "status": "affected", "version": "c69899a17ca4836230720e65493942d9582a0424", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/nfs4proc.c", "include/linux/nfs_xdr.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: use nfsi->rwsem to protect traversal of the file lock list\n\nLingfeng identified a bug and suggested two solutions, but both appear\nto have issues.\n\nGenerally, we cannot release flc_lock while iterating over the file lock\nlist to avoid use-after-free (UAF) problems with file locks. However,\nfunctions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot\nadhere to this rule because recover_lock or nfs4_lock_delegation_recall\nmay take a long time. To resolve this, NFS switches to using nfsi->rwsem\nfor the same protection, and nfs_reclaim_locks follows this approach.\nAlthough nfs_delegation_claim_locks uses so_delegreturn_mutex instead,\nthis is inadequate since a single inode can have multiple nfs4_state\ninstances. Therefore, the fix is to also use nfsi->rwsem in this case.\n\nFurthermore, after commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), the functions\nnfs4_locku_done and nfs4_lock_done also break this rule because they\ncall locks_lock_inode_wait without holding nfsi->rwsem. Simply adding\nthis protection could cause many deadlocks, so instead, the call to\nlocks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug\nfixed by commit c69899a17ca4 (\"NFSv4: Update of VFS byte range\nlock must be atomic with the stateid update\"), it has been resolved\nafter commit 0460253913e5 (\"NFSv4: nfs4_do_open() is incorrectly triggering\nstate recovery\") because all slots are drained before calling\nnfs4_do_reclaim, which prevents concurrent stateid changes along this path.\nAlso, nfs_delegation_claim_locks does not cause this concurrency either\nsince when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is\nsent, so nfs4_lock_done is not called. Therefore,\nnfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first\ntime the stateid is set."}], "id": "CVE-2026-72472", "lastModified": "2026-10-30T13:19:53.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72472", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:50:31.105592Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:21.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7813adb38c88573b730219c1dc1b630dfab7165e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e68035178e65e2b3aa386ce61202ff33724ae418"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfs: use nfsi->rwsem to protect traversal of the file lock list", "id": "2516261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516261"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Network File System (NFS) component of the Linux kernel. Inadequate synchronization during the traversal of the file lock list can lead to a use-after-free (UAF) vulnerability. This occurs when certain functions release file locks prematurely while iterating, potentially allowing a local attacker to cause a denial of service or, in some cases, execute arbitrary code."], "name": "CVE-2026-72472", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72472\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72472\nhttps://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72472-8c5c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c69899a17ca4836230720e65493942d9582a0424,1cda95bf2e9c0e6b63545b7565fe4a1e474322f4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c69899a17ca4836230720e65493942d9582a0424,f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c69899a17ca4836230720e65493942d9582a0424,e68035178e65e2b3aa386ce61202ff33724ae418)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c69899a17ca4836230720e65493942d9582a0424,4837fb36219e6c08b666bc31a86841bad8526358)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T17:45:03.069397+00:00", "updated": "2026-08-18T04:30:06.701367+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}