CVE-2026-72374afs: Fix callback service message parsers to pass through -EAGAIN
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 26b737b3769e92493fe94c34620399d93ca231ae; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 09c67a7ded481482155b836c8c7f078a3075f8de; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 772850871a2e772e26f9d93f1e9ddd413b3eeaa4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 0acbc09d2aca0432af45cec114f20d55ceafaec4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before f14dd036fad3d359f26f1282199cec06b3a9362b; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 0f36469d7ce98b362934113c550d08bb0c784231 | CNA record |
References
- https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae
- https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de
- https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6
- https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4
- https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4
- https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4
- https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b
- https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.