Linux Kernel CVE-2026-72315

Exploitation requires a local unprivileged user session (PR:L per CVSS) on a Linux host where a CIFS/SMB filesystem is actively mounted. The vulnerability is triggered only when a Direct I/O write (O_DIRECT open flag) is in flight concurrently with an unmount of the same CIFS superblock - buffered I/O writes do not exercise the affected netfs DIO code path. The race window exists between the DIO write subrequest completion on cifsd thread and the deferred workqueue cleanup on system_dfl_wq and fileinfo_put_wq. Exploitation is limited by: (1) requirement for local user access and the ability to write files on the CIFS mount, (2) the need to race a concurrent unmount with an in-progress DIO write, and (3) no network-exposed attack surface - the vulnerability is entirely local to the mounting host. Systems that do not mount CIFS/SMB filesystems, or that use only buffered I/O on such mounts, are not affected.

Real-world risk is moderate despite the 7.8 CVSS score. The AV:L vector constrains impact to authenticated local users on systems with active CIFS/SMB mounts performing DIO writes - a non-trivial combination. The EPSS score of 0.20% at the 10th percentile is consistent with the technical complexity of weaponizing a kernel race condition into a reliable privilege escalation, as opposed to a denial-of-service crash. No CISA KEV listing and no reported public exploit code further reduce urgency. The CVSS-assigned AC:L appears optimistic for a race condition that requires concurrent DIO write and unmount timing; AC:H would more accurately reflect exploitation difficulty. The high C:H/I:H/A:H impact metrics are credible if the dentry use-after-free is exploitable for kernel memory corruption, but may represent the worst-case theoretical bound rather than a consistently achievable outcome. Priority should be high for Linux hosts running CIFS client mounts (file servers, workstations mounting SMB shares) but lower than similarly-scored remote-vector kernel CVEs.

A local user on a Linux system with a CIFS/SMB share mounted initiates a large direct I/O write (O_DIRECT) to a file on the CIFS mount, then triggers or races with an unmount of that filesystem (e.g., via fusermount or a system service restart). The write completion workqueue items on system_dfl_wq and fileinfo_put_wq have not yet decremented the dentry reference count when shrink_dcache_for_umount() runs, resulting in a kernel BUG warning and a potentially exploitable use-after-free of the dentry structure. No public proof-of-concept exploit has been identified at time of analysis; reliable exploitation for privilege escalation would require precise race-condition timing and kernel heap manipulation.