CVE-2026-72372afs: Fix lack of locking around modifications of net->cells_dyn_ino
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net->cells_dyn_ino Fix the lack of locking around modifications of net->cells_dyn_ino by taking net->cells_lock exclusively. This also requires to cell to be removed from net->cells_dyn_ino in afs_destroy_cell_work() rather than in afs_cell_destroy() as the latter runs in RCU cleanup context and sleeping locks cannot be taken there.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 537b0105952578531f748c7fb3ce36ae9a514784 builds before 4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b; from 1d0b929fc070b4115403a0a6206a0c6a62dd61f5 before 2ffb70a8a01988046bb207b7d0af9358a8337378; from 1d0b929fc070b4115403a0a6206a0c6a62dd61f5 before e94f92fd56c553a8bf9421c3289e1b85c7c08857; from 1d0b929fc070b4115403a0a6206a0c6a62dd61f5 before 55e841836c6f4646490f7b0347192b7a92d431ba; from 6.12.97 before 6.12.101 | CNA record |
References
- https://git.kernel.org/stable/c/4d8a2fe8847859f4fa4e9a2fa1221c9c1158e66b
- https://git.kernel.org/stable/c/2ffb70a8a01988046bb207b7d0af9358a8337378
- https://git.kernel.org/stable/c/e94f92fd56c553a8bf9421c3289e1b85c7c08857
- https://git.kernel.org/stable/c/55e841836c6f4646490f7b0347192b7a92d431ba
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.