CVE-2026-72365

A flaw was found in the netfs component of the Linux kernel. This vulnerability arises from incorrect handling of NETFS_RREQ_OFFLOAD_COLLECTION during writethrough operations. This issue could lead to asynchronous O_SYNC writes not being properly collected, potentially resulting in data inconsistency or loss.

This vulnerability is rated as Moderate severity because exploitation requires authenticated local access to trigger uncollected asynchronous write operations on mounted network filesystems, limiting the potential impact to data corruption or denial of service rather than privilege escalation. The issue only manifests in environments that actively utilize network filesystems configured with writethrough caching. Earlier enterprise releases, including Red Hat Enterprise Linux 8 and 9, do not incorporate the affected subsystem changes and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.