Skip to main content

Linux Kernel CVE-2026-72371

| EUVDEUVD-2026-59270 HIGH
2026-08-15 Linux GHSA-446r-vwhm-chv5
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local low-privilege access sufficient to trigger AFS volume operations; full C/I/A impact reflects kernel memory corruption potential from double-free.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:51 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix the volume AFS_VOLUME_RM_TREE is set on

Fix afs_insert_volume_into_cell() to set AFS_VOLUME_RM_TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be removed from the tree twice and the new volume never to be removed.

AnalysisAI

The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.

Technical ContextAI

AFS (Andrew File System) is a distributed network filesystem implemented in the Linux kernel via the kafs module. Within AFS, a 'cell' is an administrative domain managing named volumes, which are tracked in a kernel-internal tree structure. The function afs_insert_volume_into_cell() handles the insertion of a new volume into this tree, evicting a prior volume when a name collision occurs. The AFS_VOLUME_RM_TREE flag is the signal that a volume has been displaced and should be removed from the tree. The bug applies this flag to the incoming new volume rather than the outgoing replaced volume, corrupting tree state. No formal CWE was assigned, but the root cause maps to CWE-672 (Operation on a Resource after Expiration or Release) or CWE-415 (Double Free), as the replaced volume's removal will be triggered twice while the new volume's removal is never triggered. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable kernel branches.

RemediationAI

Update to a patched Linux stable kernel release: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2 (or any later release in those series), depending on the branch in use. Upstream fix commits are published at https://git.kernel.org/stable/c/6fa9a8a73e16aa22fce6e41cc00d59c767f0a540, https://git.kernel.org/stable/c/c421bc6b957e56e45e12dbaeaf70a60db20d6465, https://git.kernel.org/stable/c/1607075220cf57161d9116512994c159eacefc0d, and four additional stable backport commits listed in the references. As a compensating control for systems that do not require AFS, preventing the kafs module from loading (via /etc/modprobe.d/ blocklist or kernel build without CONFIG_AFS_FS) eliminates the attack surface entirely with no operational trade-off for non-AFS workloads. Where AFS is required, restricting local shell access to untrusted users on AFS-mounted hosts limits the population of potential attackers until patching is complete.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72371 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy