Skip to main content

Linux Kernel CVE-2026-72378

| EUVDEUVD-2026-59277 HIGH
2026-08-15 Linux GHSA-2wjr-8gx8-q69w
Information Disclosure Linux Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Attacker must control or spoof a trusted AFS VL server response, requiring non-trivial network positioning (AC:H); no target-system privileges needed; availability impact only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:55 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.5
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix error code in afs_extract_vl_addrs()

The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration.

AnalysisAI

Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in afs_extract_vl_addrs(), potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.

Technical ContextAI

The affected function afs_extract_vl_addrs() parses replies from AFS Volume Location (VL) servers, which map AFS volume names to file server addresses as part of the kernel's kafs (kAFS) implementation. The root cause is a loop error-code assignment defect: the error variable is set only on the first loop iteration, so any subsequent iteration processes VL address records without updating the error value, propagating stale or zero error codes up the call stack. NVD lists CWE as N/A, but this pattern corresponds to improper error handling (similar to CWE-391 or CWE-392). CPE data identifies the affected product as cpe:2.3:a:linux:linux:*, with the vulnerability introduced at commit 0a5143f2f89cc88d8a3eada8e8ccd86c1e988257 (Linux 4.20) across all stable branches until the respective backport commits were applied.

RemediationAI

Upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, or 6.18.40, with individual stable-tree fix commits referenced at https://git.kernel.org/stable/c/7ce6737a975ea3e0dc2e5946628d233779ca0caf and related commits in the references. For systems that cannot be patched immediately and do not require AFS, the kafs kernel module can be blocked from loading by adding blacklist kafs to /etc/modprobe.d/blacklist.conf and running update-initramfs -u; this fully eliminates the attack surface but disables all AFS filesystem functionality. Systems not loading the kafs module are not affected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72378 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy