CVE-2026-72355 (GCVE-0-2026-72355)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-09-21 13:13
VLAI
Title
netfs: Fix barriering when walking subrequest list
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 288ace2f57c9d06dd2e42bd80d03747d879a4068 , < 4cca4b44e561a19c77cb1949ae6846da0539db40 (git)
Affected: 288ace2f57c9d06dd2e42bd80d03747d879a4068 , < be47c047250671c9225c0319ca4695be9b391c59 (git)
Affected: 288ace2f57c9d06dd2e42bd80d03747d879a4068 , < 5c6ce05e406520290c1d89da97fb3cd70c09137d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/read_retry.c",
            "fs/netfs/write_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4cca4b44e561a19c77cb1949ae6846da0539db40",
              "status": "affected",
              "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
              "versionType": "git"
            },
            {
              "lessThan": "be47c047250671c9225c0319ca4695be9b391c59",
              "status": "affected",
              "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
              "versionType": "git"
            },
            {
              "lessThan": "5c6ce05e406520290c1d89da97fb3cd70c09137d",
              "status": "affected",
              "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/read_retry.c",
            "fs/netfs/write_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix barriering when walking subrequest list\n\nFix the barriering used when walking the subrequest list in retry as\nthere\u0027s a possibility of seeing a subreq that\u0027s just been added by the\napplication thread."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the netfs client retry path used by SMB/CIFS, Ceph, NFS+fscache, and AFS; a remote malicious or MITM file server can trigger NEED_RETRY via short/error network responses during client read/write I/O.\nAC:L - The attacker controls both sides of the race by timing retry-inducing server responses and issuing concurrent reads/writes (multiple threads/fds); no victim-specific memory layout or rare uncontrollable state is required beyond normal mounted-FS I/O.\nPR:N - No local privileges on the victim are required; a remote attacker operating a malicious or compromised SMB/Ceph/NFS/AFS server can exploit any client with an active mount performing file I/O, without shell or admin access on the client.\nUI:N - On commonly pre-mounted enterprise/automounted network shares, kernel readahead and writeback can reach the buggy retry path without additional victim action at exploitation time beyond existing background file access.\nS:U - Exploitation corrupts the client kernel heap and enables local privilege escalation within the same kernel security domain; it does not by itself cross a VM/host or IOMMU boundary.\nC:H - Observing partially published subrequest entries yields stale start/len/flags/io_iter values, causing out-of-bounds kernel reads and information disclosure from adjacent memory via mis-sized iterators.\nI:H - Corrupted subrequest metadata drives wrong-span reissue_read/write, erroneous list deletion, and refcount manipulation, providing heap corruption primitives that can be leveraged for arbitrary kernel writes and code execution.\nA:H - Incorrect list traversal and mis-issued I/O can cause use-after-free, refcount underflow, kernel oops, or panic, reliably crashing or hanging the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:13:45.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4cca4b44e561a19c77cb1949ae6846da0539db40"
        },
        {
          "url": "https://git.kernel.org/stable/c/be47c047250671c9225c0319ca4695be9b391c59"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"
        }
      ],
      "title": "netfs: Fix barriering when walking subrequest list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72355",
    "datePublished": "2026-08-15T05:55:56.812Z",
    "dateReserved": "2026-08-09T03:40:39.921Z",
    "dateUpdated": "2026-09-21T13:13:45.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72355",
      "date": "2026-09-20",
      "epss": "0.00554",
      "percentile": "0.45071"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/netfs/read_retry.c",
                  "fs/netfs/write_retry.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "be47c047250671c9225c0319ca4695be9b391c59",
                    "status": "affected",
                    "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c6ce05e406520290c1d89da97fb3cd70c09137d",
                    "status": "affected",
                    "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/netfs/read_retry.c",
                  "fs/netfs/write_retry.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix barriering when walking subrequest list\n\nFix the barriering used when walking the subrequest list in retry as\nthere\u0027s a possibility of seeing a subreq that\u0027s just been added by the\napplication thread."
          }
        ],
        "id": "CVE-2026-72355",
        "lastModified": "2026-08-17T06:18:39.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:08.960",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be47c047250671c9225c0319ca4695be9b391c59"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:39:48+00:00",
      "cve": "CVE-2026-72355",
      "id": "CVE-2026-72355",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfs: Fix barriering when walking subrequest list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72355.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:29:34Z",
      "cve": "CVE-2026-72355",
      "id": "CVE-2026-72355",
      "initial_release_date": "2026-08-25T01:22:00Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72355",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72355.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.