CVE-2026-72374 (GCVE-0-2026-72374)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:43
VLAI
Title
afs: Fix callback service message parsers to pass through -EAGAIN
Summary
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 26b737b3769e92493fe94c34620399d93ca231ae (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 09c67a7ded481482155b836c8c7f078a3075f8de (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6 (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4 (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 772850871a2e772e26f9d93f1e9ddd413b3eeaa4 (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 0acbc09d2aca0432af45cec114f20d55ceafaec4 (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < f14dd036fad3d359f26f1282199cec06b3a9362b (git)
Affected: d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 , < 0f36469d7ce98b362934113c550d08bb0c784231 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/cmservice.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26b737b3769e92493fe94c34620399d93ca231ae",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "09c67a7ded481482155b836c8c7f078a3075f8de",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "239cd337c9d047e7097f5b2ebbb41ddfb8180bc6",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "5a39b145a8fb49f316e7ec1f29ba51d68095c7e4",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "772850871a2e772e26f9d93f1e9ddd413b3eeaa4",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "0acbc09d2aca0432af45cec114f20d55ceafaec4",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "f14dd036fad3d359f26f1282199cec06b3a9362b",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            },
            {
              "lessThan": "0f36469d7ce98b362934113c550d08bb0c784231",
              "status": "affected",
              "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/cmservice.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications.  Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn\u0027t yet been seen, but all currently queued received data is\nconsumed.  afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote RxRPC traffic to the kafs cache manager on UDP/TCP port 7001 reaches afs_deliver_cb_init_call_back_state3() and afs_deliver_cb_probe_uuid() via rxrpc incoming-call handling (afs_rx_new_call \u2192 afs_deliver_cm_op_id \u2192 afs_cm_incoming_call \u2192 deliver parsers).\nAC:L - An attacker who controls an established callback RxRPC session can reliably force -EAGAIN by fragmenting CB.InitCallBackState3 or CB.ProbeUuid DATA across multiple packets; no special memory layout, races beyond attacker pacing, or rare victim state is required.\nPR:N - No local Linux account or capabilities on the victim are needed; exploitation is driven by a remote RxRPC peer sending fragmented cache-manager callbacks after the encrypted handshake on the callback socket (minimum RXRPC_SECURITY_ENCRYPT).\nUI:N - No victim user action (mounting AFS, opening files, or clicking anything) is required at exploit time; only an active kafs client with its per-net callback listener is needed as deployment context.\nS:U - Impact is confined to kernel/AFS cache-manager state on the victim host (NULL dereference oops, panic, or callback-protocol disruption) and does not cross VM, IOMMU, or sandbox security boundaries.\nC:N - The -EAGAIN mishandling returns success before UUID unmarshalling, leaving call-\u003erequest NULL; SRXAFSCB_ProbeUuid passes that pointer to memcmp(), causing a kernel fault without attacker-visible disclosure of victim data.\nI:N - The failure mode is premature parser completion and a NULL-pointer memcmp in SRXAFSCB_ProbeUuid (plus possible premature CM replies on InitCallBackState3); no arbitrary kernel write, heap corruption, or code-execution primitive is demonstrated.\nA:H - Treating -EAGAIN as success queues SRXAFSCB_ProbeUuid while call-\u003erequest is still NULL, and memcmp() on that pointer causes a kernel oops/panic; a remote peer can retrigger this on demand with fragmented CB.ProbeUuid callbacks."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:27.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"
        },
        {
          "url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"
        }
      ],
      "title": "afs: Fix callback service message parsers to pass through -EAGAIN",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72374",
    "datePublished": "2026-08-15T05:56:09.182Z",
    "dateReserved": "2026-08-09T03:40:39.922Z",
    "dateUpdated": "2026-08-17T05:43:27.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72374",
      "date": "2026-09-20",
      "epss": "0.00707",
      "percentile": "0.51983"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/cmservice.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "26b737b3769e92493fe94c34620399d93ca231ae",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09c67a7ded481482155b836c8c7f078a3075f8de",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "239cd337c9d047e7097f5b2ebbb41ddfb8180bc6",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a39b145a8fb49f316e7ec1f29ba51d68095c7e4",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "772850871a2e772e26f9d93f1e9ddd413b3eeaa4",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0acbc09d2aca0432af45cec114f20d55ceafaec4",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f14dd036fad3d359f26f1282199cec06b3a9362b",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f36469d7ce98b362934113c550d08bb0c784231",
                    "status": "affected",
                    "version": "d001648ec7cf8b21ae9eec8b9ba4a18295adfb14",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/cmservice.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications.  Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn\u0027t yet been seen, but all currently queued received data is\nconsumed.  afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN"
          }
        ],
        "id": "CVE-2026-72374",
        "lastModified": "2026-08-17T06:18:41.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:10.873",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T06:53:06+00:00",
      "cve": "CVE-2026-72374",
      "id": "CVE-2026-72374",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: afs: Fix callback service message parsers to pass through -EAGAIN",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72374.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:27:40Z",
      "cve": "CVE-2026-72374",
      "id": "CVE-2026-72374",
      "initial_release_date": "2026-09-03T00:07:28Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72374",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72374.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.