CVE-2026-72373

A flaw was found in the AFS (Andrew File System) component of the Linux kernel. A missing NULL pointer check in the afs_break_some_callbacks() function could allow a local attacker to trigger a kernel panic, leading to a denial of service. This occurs when the afs_lookup_volume_rcu() function returns a NULL value, indicating an unknown volume.

A moderate impact flaw was found in the Linux kernel AFS (Andrew File System) client. The afs_break_some_callbacks() function did not check whether afs_lookup_volume_rcu() returned NULL for an unknown volume, so processing a callback break for an unknown volume could dereference a NULL pointer and cause a kernel panic, resulting in a denial of service. Only system availability is affected; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 kernel and kernel-rt components and Red Hat In-Vehicle OS 2 kernel components, the fix is deferred because this is a moderate-severity, availability-only denial of service with no confidentiality or integrity impact; the residual risk is that a trigger through AFS volume callback processing crashes the system. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflecting a local attack vector requiring privileges, which differs from the upstream CVE record severity of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), where the network vector considers a malicious or compromised AFS server triggering the crash remotely on AFS client systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.