CVE-2026-72372
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel's AFS filesystem, there is a lack of locking around modifications of net->cells_dyn_ino. The fix requires taking net->cells_lock exclusively and moving the removal of the cell from net->cells_dyn_ino to afs_destroy_cell_work(), because afs_cell_destroy() runs in RCU cleanup context.
Risk Assessment
Lack of synchronization could lead to races, potentially resulting in data corruption or system crash. The vulnerability affects AFS clients.
Recommendation
Apply the kernel patch that adds proper locking and moves the cell removal. Update your system to a kernel version with this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net->cells_dyn_ino Fix the lack of locking around modifications of net->cells_dyn_ino by taking net->cells_lock exclusively. This also requires to cell to be removed from net->cells_dyn_ino in afs_destroy_cell_work() rather than in afs_cell_destroy() as the latter runs in RCU cleanup context and sleeping locks cannot be taken there.