CVE-2026-72170

A flaw was found in the Linux kernel's 9p filesystem. A race condition can occur during file unlinking operations in cacheless mode, where the v9fs_dec_count() function attempts to decrement a file's link count (nlink) that has already reached zero. This leads to a kernel warning, which could potentially cause system instability or a denial of service (DoS).

This vulnerability is rated as Moderate severity because it requires local access with an active Plan 9 (9p) network filesystem mounted in a non-caching configuration, limiting the blast radius to a localized denial of service. The 9p filesystem is not mounted by default across standard enterprise environments and is predominantly utilized in niche virtualization sharing scenarios. Triggering the flaw requires concurrent file unlinking under heavy workload conditions, resulting in a kernel warning rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.