CVE-2026-72366

Received Received - Intake

Linux Kernel Netfs Async Cache Object Creation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle async cache object creation netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped. Fix this by removing the checks on the cookie and delegating this to fscache_begin_write_operation().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72366

EUVD

EUVD-2026-59265

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in netfs_create_write_req() where it incorrectly skips caching when the fscache cookie is disabled. This can lead to issues because async cache object creation may not have completed, causing fscache_begin_write_operation() to be skipped entirely.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfs subsystem and does not have direct network or system detection commands. It requires kernel code inspection or patch application to resolve. Monitor kernel logs for errors related to netfs or fscache operations.

Impact Analysis

This vulnerability could lead to data corruption or loss if write operations fail to properly cache data due to the skipped fscache_begin_write_operation(). It may affect systems relying on network filesystems or caching mechanisms for performance.

Compliance Impact

This vulnerability affects data integrity in the Linux kernel's netfs subsystem, which could lead to improper handling of cached data. While it does not directly impact GDPR or HIPAA compliance, it may cause data processing inconsistencies that could indirectly affect compliance if caching is used for sensitive data storage or processing.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the issue with netfs_create_write_req() handling async cache object creation.

Hi! I’m here to help you understand CVE-2026-72366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70