What is the CVSS score of CVE-2026-72366?

CVE-2026-72366 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72366?

The Linux kernel's netfs/fscache subsystem contains a critical information-disclosure flaw (CVSS 9.8) affecting versions 6.11 through 7.1.x, where asynchronous cache initialization bypasses…. A patch is available.

How to fix or mitigate CVE-2026-72366?

Within 24 hours, inventory all Linux systems running kernel versions 6.11 through 6.18.39 or 7.1.0 through 7.1.4 with fscache enabled, prioritizing production servers and those handling sensitive data. Within 7 days, test kernel updates to version 6.18.40 or later, 7.1.5 or later, or 7.2-rc2 or later in a staging environment and begin phased deployment to production, starting with servers with highest data sensitivity. Within 30 days, complete the rollout across all affected infrastructure and validate kernel versions via uname or lsb_release to confirm patch compliance.

Linux Kernel CVE-2026-72366

EUVD-2026-59265 CRITICAL

2026-08-15 Linux

GHSA-8q2x-69cw-5m48

Information Disclosure Linux Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

2.5 LOW

Local-only kernel caching bug requiring a race in async cache-object creation (AV:L, AC:H) and local access (PR:L); limited information-disclosure impact (C:L), no integrity/availability effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:48 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_create_write_req() to handle async cache object creation

netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped.

Fix this by removing the checks on the cookie and delegating this to fscache_begin_write_operation().

AnalysisAI

Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.

Technical ContextAI

The bug lives in the kernel's netfs library, the shared read/write plumbing used by network filesystems (NFS, AFS, Ceph, CIFS/SMB, 9p) that layer local caching via fscache/cachefiles. When a network filesystem writes data, netfs_create_write_req() decides whether the write should also populate the local disk cache. Cache objects backing an fscache cookie can be created asynchronously, so there is a window where the cookie's caching state is not yet fully enabled. The original code short-circuited on the cookie's apparent disabled state, skipping fscache_begin_write_operation(); the fix removes those early cookie checks and delegates the enable/skip decision to fscache_begin_write_operation() itself, which correctly accounts for in-flight async object creation. The upstream CWE is not classified (CWE: N/A); functionally this is a state/race-window logic error in cache initialization rather than a memory-safety flaw.

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.40, 7.1.5, or 7.2-rc2 (or any later release on your branch), which carry the netfs_create_write_req() fix (commits https://git.kernel.org/stable/c/8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a, https://git.kernel.org/stable/c/1188a9846fadeacf9d1430b528e5217f749d665b, and https://git.kernel.org/stable/c/dbd6f56d975b23241b7bbb11bb8f562af548a0aa); for distribution kernels, take the vendor backport rather than the exact upstream tag. If immediate patching is not possible, the concrete compensating control is to disable fscache local caching for the affected network filesystem mounts - for example remove the 'fsc' mount option on NFS/CIFS mounts or unload/disable the cachefiles backend - which removes the vulnerable code path entirely; the trade-off is loss of local caching performance for those network filesystems. Restricting local shell/code-execution access on affected hosts further limits reachability. Track updates via https://nvd.nist.gov/vuln/detail/CVE-2026-72366.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72366 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72366

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code