CVE-2026-72377

Received Received - Intake

Memory Corruption in Linux Kernel AFS Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs_file_aops which have release_folio set as netfs_release_folio, so AS_RELEASE_ALWAYS is valid for them when fscache is enabled (set via afs_vnode_set_cache()). Symlinks and mountpoints in AFS use afs_dir_aops, which does not provide a release_folio callback. However, afs_apply_status() unconditionally calls mapping_set_release_always() for these. In such case when memory management code attempts to release folios, filemap_release_folio() checks folio_needs_release() which returns true due to AS_RELEASE_ALWAYS being set. Since there is no release_folio callback, it falls through to try_to_free_buffers(), which at present expects buffer_heads to be not null. For symlinks and mountpoints without buffer_heads, this causes pointer dereference. [dh: Added more bits that were missed]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72377

EUVD

EUVD-2026-59276

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of symlinks and mountpoints in AFS (Andrew File System). The issue occurs because these file types use a different set of operations that lack a release_folio callback, but the system still sets AS_RELEASE_ALWAYS flag. When memory management tries to release folios, it leads to a null pointer dereference due to missing buffer_heads.

Detection Guidance

This vulnerability affects the Linux kernel's AFS (Andrew File System) implementation. Detection requires checking kernel logs for errors related to symlinks or mountpoints in AFS, such as null pointer dereferences. Use commands like dmesg | grep -i afs or journalctl -k | grep -i afs to inspect kernel logs for related errors.

Impact Analysis

This vulnerability could cause system crashes or instability when accessing AFS symlinks or mountpoints, potentially leading to denial-of-service conditions. It may also allow local attackers to trigger kernel panics or execute arbitrary code with kernel privileges.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel filesystem issue related to memory management in AFS symlinks and mountpoints. No data exposure or privacy concerns are indicated.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this vulnerability. If immediate patching is not possible, consider disabling AFS support or restricting access to AFS mountpoints and symlinks as a temporary workaround. Monitor kernel logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-72377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70