CVE-2026-72371

A flaw was found in the Linux kernel's AFS (Andrew File System) component. The afs_insert_volume_into_cell() function incorrectly sets the AFS_VOLUME_RM_TREE flag on the new volume instead of the replaced volume. This error causes the old volume to be removed twice and the new volume to remain in the cell's volume tree indefinitely, potentially leading to resource exhaustion or a denial of service.

This vulnerability is rated as Moderate severity because triggering the issue requires local access to interact with Andrew File System (AFS) volume tracking, and the AFS client filesystem is not loaded or utilized by default in standard Red Hat deployments. Under typical configurations, the affected subsystem remains inactive unless explicitly mounted by an administrator, limiting the potential blast radius. Successful exploitation could lead to an inconsistent volume tree state, resulting in memory leaks or a denial-of-service condition rather than remote arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.