What is the CVSS score of CVE-2026-72356?

CVE-2026-72356 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72356?

A resource-exhaustion vulnerability in the Linux kernel CIFS client affects organizations using network file shares for storage.. A patch is available.

How to fix or mitigate CVE-2026-72356?

Within 24 hours, identify all Linux systems running vulnerable kernel versions (commit 69c3c023af25edb5433a2db824d3e7cc328f0183 through 6.12.96, 6.18.39, 7.1.4, and earlier 7.2-rc releases) and document which host production CIFS mounts. Within 7 days, apply vendor-released patches to kernel versions 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2 depending on your kernel series, prioritizing systems with critical CIFS workloads. Complete patching all affected systems within 30 days and test CIFS mount I/O stability post-update to confirm proper credit pool restoration.

Linux Kernel CVE-2026-72356

EUVD-2026-59255 HIGH

2026-08-15 Linux

GHSA-fvfj-x9c7-958j

Information Disclosure Linux Red Hat Suse

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AC raised to H because exploitation requires attacker control of a server the victim actively mounts; PR:N since the attacker operates server-side; A:H for full mount stall.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:45 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.5 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix missing credit release on failure in cifs_issue_read()

Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.

AnalysisAI

Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.

Technical ContextAI

The Linux kernel CIFS client implements the SMB/CIFS protocol for mounting remote Windows and Samba file shares. SMB uses a credits mechanism as a flow-control quota: the server grants the client a finite number of outstanding request slots. In the async read path, cifs_issue_read() acquires credits before issuing a read operation. The defect is in the failure path: when cifs_issue_read() returns an error, it fails to release the acquired credits back to the pool. When the caller retries the subrequest, it simply overwrites the stale credits value rather than adding to the pool, causing a permanent per-failure credit leak. Repeated triggering of this failure path drains the credit pool entirely, after which the CIFS client can issue no further requests to the server and all I/O on that mount stalls. The CWE is not formally assigned in the input data, but the root cause class is a resource management error (analogous to CWE-772: Missing Release of Resource after Effective Lifetime). Affected product is identified via CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2, incorporating the fixes committed at https://git.kernel.org/stable/c/b9ee1f0347bf56d019ca28ddff090234bb45b05c, https://git.kernel.org/stable/c/86652704a7fd41a5a8459027e08640bbd1952826, https://git.kernel.org/stable/c/3a303f985c6bec8787c2ad4a16b39c14c5bcd765, and https://git.kernel.org/stable/c/c16b8c4cfb4fe2244cc33e469a93c1ab8684146b. Linux distribution vendors (Debian, Ubuntu, Red Hat, SUSE) are expected to backport these commits to their supported kernel packages; check distribution security advisories for package-specific fix versions. If immediate patching is not possible, unmounting CIFS shares from untrusted or externally reachable servers eliminates the attack surface at the cost of losing access to those shares. Restricting SMB traffic (TCP 445) at the perimeter to only trusted server IPs limits the attacker-controlled-server vector without disrupting internal file share access. No generic workaround restores CIFS functionality while fully mitigating the credit leak without a kernel patch.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72356 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72356

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code