CVE-2026-72372

A flaw was found in the AFS (Andrew File System) component of the Linux kernel. This vulnerability arises from insufficient locking mechanisms when modifying internal data structures related to dynamic inode management. An attacker could potentially exploit this weakness, leading to system instability or a denial of service (DoS), where the system becomes unresponsive or crashes. The issue has been resolved by implementing exclusive locking during these critical operations.

A moderate-severity flaw was found in the AFS (Andrew File System) implementation of the Linux kernel. The per-network-namespace dynamic-root inode bookkeeping (net->cells_dyn_ino) was modified without holding the required cells_lock, so concurrent cell addition, cell removal, and dynamic-root lookup or readdir operations could race and observe inconsistent internal state, causing kernel instability or a crash. A local user with access to an AFS dynamic-root mount could trigger this race, resulting in a denial of service; no confidentiality or integrity impact has been established. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 contain the vulnerable code (introduced by the change that made dynroot create contents on demand) and are affected. The fix is currently deferred for these streams because the upstream correction restructures cell destruction, moving the cells_dyn_ino removal out of RCU cleanup context into a work handler, which is not a simple backport; the residual risk is limited to local denial of service on systems using AFS dynamic root. Red Hat Enterprise Linux 6, 7, 8, and 9, as well as RHEL 10.0, do not contain the vulnerable code and are therefore not affected. Red Hat rates this flaw Moderate (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the established impact is availability only; the higher upstream CVE.org severity of Important (7.8) reflects an assumption of confidentiality and integrity impact from the race that Red Hat's assessment does not establish.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.