Skip to main content

Linux Kernel CVE-2026-72375

| EUVDEUVD-2026-59274 HIGH
2026-08-15 Linux GHSA-fpj5-fm3g-5rvj
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector confirmed by kernel-only access path; PR:L because any unprivileged user with AFS access can trigger it; high CIA reflects kernel-space impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:55 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix reinitialisation of the inode, in particular ->lock_work

It seems that initalising afs_vnode::lock_work a single time in the slab's init function isn't sufficient for work_structs. This results in the DEBUG_OBJECTS debugging stuff producing a warning occasionally when running the generic/131 xfstest:

ODEBUG: activate not available (active state 0) object: 0000000016d8760f object type: work_struct hint: afs_lock_work+0x0/0x220 WARNING: lib/debugobjects.c:629 at debug_print_object+0x4b/0x90, CPU#3: locktest/7695 ... CPU: 3 UID: 0 PID: 7695 Comm: locktest Tainted: G S 7.1.0-build3+ #2771 PREEMPT ... RIP: 0010:debug_print_object+0x65/0x90 ... Call Trace: <TASK> ? __pfx_afs_lock_work+0x10/0x10 debug_object_activate+0x122/0x170 insert_work+0x25/0x60 __queue_work+0x2e0/0x340 queue_delayed_work_on+0x48/0x70 afs_fl_release_private+0x57/0x70 locks_release_private+0x5c/0xa0 locks_free_lock+0xe/0x20 posix_lock_inode+0x55f/0x5b0 locks_lock_inode_wait+0x81/0x140 ? file_write_and_wait_range+0x50/0x70 afs_lock+0xcd/0x110 fcntl_setlk+0x10d/0x260 do_fcntl+0x24e/0x5b0 __do_sys_fcntl+0x6a/0x90 do_syscall_64+0x11e/0x310 entry_SYSCALL_64_after_hwframe+0x71/0x79

Fix this by reinitialising ->lock_work after allocating an inode.

Also, flush ->lock_work when the inode is being evicted to make sure it's not still running.

AnalysisAI

Improper re-initialization of the AFS inode's work_struct (lock_work) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.

Technical ContextAI

The Andrew File System (AFS) driver in the Linux kernel maintains per-inode state via the afs_vnode structure. This structure includes a lock_work field of type work_struct, used to queue asynchronous lock-release work via the kernel workqueue subsystem. When inodes are allocated from the slab cache and reused, the kernel relies on a slab-init function to initialize the work_struct. However, work_struct objects managed by the DEBUG_OBJECTS kernel subsystem require re-initialization upon each reuse of the containing object - a single slab-init call is insufficient. As a result, when afs_fl_release_private() calls queue_delayed_work_on() during lock release, the kernel's ODEBUG framework detects the work_struct in an unexpected 'active state 0', raising a warning. Without DEBUG_OBJECTS, the underlying uninitialized or stale work_struct state can cause undefined kernel behavior. The CWE is not formally assigned, but this is a CWE-665 (Improper Initialization) class defect. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 6.18.40, 7.1.5, or 7.2-rc2, which contain the fix that reinitializes ->lock_work after inode allocation and flushes the work on inode eviction. The three upstream fix commits are available at https://git.kernel.org/stable/c/63d3f283858fae097fb09ddd4ce46bb0bc1f9d01, https://git.kernel.org/stable/c/ebfd13c0367adb43d7c0a72f5cd7e004e60c6b28, and https://git.kernel.org/stable/c/5597fbd1e7c161914f20315a726e54025b0fdadb. For environments that cannot patch immediately and actively use AFS, the practical workaround is to restrict user access to AFS mounts via mount namespace controls or by unmounting AFS until patching is possible - this eliminates the attack surface at the cost of AFS availability. Systems not configured with AFS are not affected and require no action. Distribution-specific kernels (RHEL, Ubuntu, Debian, SUSE) should release backported packages; check vendor errata for exact package versions.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72375 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy