CVE-2026-72374
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In the Linux kernel's AFS filesystem, callback service message parsers do not pass through -EAGAIN correctly. afs_extract_data() returns -EAGAIN, but it is inadvertently converted to 0, which can lead to incorrect processing.
Risk Assessment
This could lead to incorrect handling of callback notifications, potentially resulting in data inconsistency or AFS client crash.
Recommendation
Apply the kernel patch that ensures -EAGAIN is passed through in the parsers. Update your system to a kernel version with this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN