What is the CVSS score of CVE-2026-72368?

CVE-2026-72368 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72368?

CVE-2026-72368 affects Linux kernel systems using cachefiles-based network filesystem caching, allowing local attackers with low-privilege access to achieve privilege escalation or cause kernel…. A patch is available.

How to fix or mitigate CVE-2026-72368?

Within 24 hours, inventory all Linux systems using cachefiles for network filesystem caching by reviewing kernel configurations and mount options. Within 7 days, obtain and test patches from the Linux kernel stable tree in a staging environment, then plan rollout to vulnerable systems with priority given to production infrastructure. Within 30 days, complete kernel updates across all affected systems, verifying patch application through kernel version audits and regression testing of network filesystem performance.

Linux Kernel CVE-2026-72368

EUVD-2026-59267 HIGH

2026-08-15 Linux

GHSA-h4x8-g6jq-m2w5

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

OOM-triggered double-unlock requires non-trivial preconditions (cachefiles active plus memory pressure), warranting AC:H over the NVD's AC:L; PR:L and full CIA impact are well-supported.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:50 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix double unlock in nomem_d_alloc error path

When start_creating() fails and returns -ENOMEM, it has already released the parent directory lock in __start_dirop():

static struct dentry *__start_dirop(...) { ... inode_lock_nested(dir, I_MUTEX_PARENT); dentry = lookup_one_qstr_excl(name, parent, lookup_flags); if (IS_ERR(dentry)) inode_unlock(dir); <-- Lock released on error return dentry; }

However, the nomem_d_alloc error path in cachefiles_get_directory() unconditionally calls inode_unlock(d_inode(dir)) again, causing a double unlock that corrupts the rwsem state.

This is a leftover from commit 7ab96df840e60 which replaced manual locking with start_creating() but failed to update the nomem_d_alloc path (while correctly updating mkdir_error and lookup_error paths).

AnalysisAI

Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.

Technical ContextAI

The vulnerability resides in the Linux kernel's cachefiles module (cpe:2.3:a:linux:linux), which provides a persistent local disk cache for network filesystems such as NFS and CIFS via the fscache layer. The bug is in cachefiles_get_directory(): when start_creating() is called to create a cache directory entry and fails with -ENOMEM, the internal helper __start_dirop() has already unconditionally called inode_unlock() on the parent directory inode to release the rwsem (read-write semaphore). The nomem_d_alloc error path in cachefiles_get_directory() then calls inode_unlock(d_inode(dir)) a second time, causing a double unlock that corrupts the rwsem internal state. The root cause is an incomplete refactoring introduced by commit 7ab96df840e60, which replaced manual locking with start_creating() but updated only the mkdir_error and lookup_error paths, overlooking the nomem_d_alloc path. Although no CWE is formally assigned, this maps to improper locking (analogous to CWE-667) and potentially CWE-415 logic applied to synchronization primitives.

RemediationAI

Apply the upstream kernel stable-tree patches at https://git.kernel.org/stable/c/8c256fba2b46020004201c500b2a1fbc707a33ef and https://git.kernel.org/stable/c/26757dac15175f2a42e3537f1ba86e62456d48f1, which remove the redundant inode_unlock() call from the nomem_d_alloc error path in cachefiles_get_directory(). Distribution users should apply security updates from their vendor once backported packages are released. As a compensating control where kernel update is not immediately feasible, unloading or blacklisting the cachefiles module (via 'rmmod cachefiles' or adding 'blacklist cachefiles' to /etc/modprobe.d/) fully eliminates the vulnerable code path with the trade-off of disabling local disk caching for network filesystems, which may degrade NFS or CIFS read performance. Systems that do not mount network filesystems with caching enabled are not exposed and require no action.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72368 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72368

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code