CVE-2026-72366 (GCVE-0-2026-72366)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:43
VLAI
Title
netfs: Fix netfs_create_write_req() to handle async cache object creation
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle async cache object creation netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped. Fix this by removing the checks on the cookie and delegating this to fscache_begin_write_operation().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7b589a9b45ae32aa9d7bece597490e141198d7a6 , < 8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a (git)
Affected: 7b589a9b45ae32aa9d7bece597490e141198d7a6 , < 1188a9846fadeacf9d1430b528e5217f749d665b (git)
Affected: 7b589a9b45ae32aa9d7bece597490e141198d7a6 , < dbd6f56d975b23241b7bbb11bb8f562af548a0aa (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/write_issue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a",
              "status": "affected",
              "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
              "versionType": "git"
            },
            {
              "lessThan": "1188a9846fadeacf9d1430b528e5217f749d665b",
              "status": "affected",
              "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
              "versionType": "git"
            },
            {
              "lessThan": "dbd6f56d975b23241b7bbb11bb8f562af548a0aa",
              "status": "affected",
              "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/write_issue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_create_write_req() to handle async cache object creation\n\nnetfs_create_write_req() will skip caching if the fscache cookie is\ndisabled, but this is a problem because async cache object creation might\nnot have got far enough yet that has been enabled - thereby causing the\ncall to fscache_begin_write_operation() to be skipped.\n\nFix this by removing the checks on the cookie and delegating this to\nfscache_begin_write_operation()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in netfs client write/cache coordination for CIFS, NFS+fscache, Ceph, AFS, and 9p. A malicious remote filesystem server can deliver file data and control protocol timing to drive async fscache object creation and subsequent kernel writeback over the network.\nAC:L - The attacker controls both sides of the race by interleaving reads and writes or triggering writeback while the fscache cookie is still in CREATING/LOOKING_UP; the async-creation window can be hit reliably with retries, not conditions outside attacker influence.\nPR:N - A malicious NFS/SMB/Ceph server needs no privileges on the victim client; once a fscache-enabled mount to that server exists, exploitation requires only ordinary file access or automated writeback, not real root or init-namespace capabilities.\nUI:N - After a triggering read from the remote server, kernel writeback can invoke netfs_writepages without further victim action; an attacker with file access can also drive the race directly through concurrent read/write syscalls.\nS:U - Impact is kernel heap/folio corruption during local pagecache I/O within the same kernel security authority; it does not inherently cross VM, container, IOMMU, or sandbox boundaries.\nC:H - Skipping fscache_begin_write_operation desynchronizes cache and writeback streams; the same netfs/fscache subsystem previously produced UAFs when PG_private_2 coordination failed, enabling disclosure via freed/reused folio memory.\nI:H - Inconsistent dual-stream write completion can free or reuse folios while still referenced, yielding heap corruption primitives that related netfs fscache bugs have leveraged for arbitrary kernel writes and privilege escalation.\nA:H - The related netfs fscache fix documented kernel oops, ceph caps warnings, RCU expedited stalls, and UAF crashes from this coordination failure class; skipping required cache setup can oops, panic, or hang the system during writeback."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:19.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1188a9846fadeacf9d1430b528e5217f749d665b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbd6f56d975b23241b7bbb11bb8f562af548a0aa"
        }
      ],
      "title": "netfs: Fix netfs_create_write_req() to handle async cache object creation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72366",
    "datePublished": "2026-08-15T05:56:04.016Z",
    "dateReserved": "2026-08-09T03:40:39.922Z",
    "dateUpdated": "2026-08-17T05:43:19.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72366",
      "date": "2026-09-22",
      "epss": "0.00641",
      "percentile": "0.49314"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/netfs/write_issue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a",
                    "status": "affected",
                    "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1188a9846fadeacf9d1430b528e5217f749d665b",
                    "status": "affected",
                    "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbd6f56d975b23241b7bbb11bb8f562af548a0aa",
                    "status": "affected",
                    "version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/netfs/write_issue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_create_write_req() to handle async cache object creation\n\nnetfs_create_write_req() will skip caching if the fscache cookie is\ndisabled, but this is a problem because async cache object creation might\nnot have got far enough yet that has been enabled - thereby causing the\ncall to fscache_begin_write_operation() to be skipped.\n\nFix this by removing the checks on the cookie and delegating this to\nfscache_begin_write_operation()."
          }
        ],
        "id": "CVE-2026-72366",
        "lastModified": "2026-08-17T06:18:40.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:10.017",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1188a9846fadeacf9d1430b528e5217f749d665b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dbd6f56d975b23241b7bbb11bb8f562af548a0aa"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:26:30Z",
      "cve": "CVE-2026-72366",
      "id": "CVE-2026-72366",
      "initial_release_date": "2026-08-25T01:21:58Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "333",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72366",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72366.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.