CVE-2026-72368

A flaw was found in the cachefiles component of the Linux kernel. When a directory creation operation fails due to memory exhaustion, a double unlock of the parent directory lock occurs. This issue corrupts the read-write semaphore (rwsem) state, which can lead to system instability or a kernel panic, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate because successful exploitation requires local user interaction under specific memory pressure constraints and only results in a system crash without compromising confidentiality or integrity. The affected cachefiles subsystem is not active by default and is only engaged when local caching for network filesystems is explicitly configured. Because triggering the synchronization corruption requires an out-of-memory failure during directory creation, standard system operations are unlikely to encounter this condition under normal operating parameters.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.