CVE-2026-72374

A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This improper handling of error conditions could lead to unexpected behavior or resource issues within the AFS client.

A MODERATE severity flaw was found in the Linux kernel's AFS filesystem client as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The AFS client listens for callback notifications on an rxrpc server, and the delivery functions that parse incoming callback request streams incorrectly convert the -EAGAIN return value from afs_extract_data() to 0 when the last packet of a message has not yet been received but all currently queued data has been consumed. As a result, an incomplete callback message can be treated as successfully parsed, causing protocol state confusion. A malicious or compromised AFS fileserver, or an attacker able to tamper with AFS callback traffic, could exploit this by sending a partial callback message to a client that has mounted an AFS share, leading to a denial of service of AFS client callback processing; there is no evidence of memory corruption or privilege escalation, and the impact is limited to availability. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, while Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Because this is a moderate, availability-only issue whose exposure is limited to systems actually using the AFS filesystem, the fix has been deferred to a future update of the affected streams; the residual risk is potential disruption of AFS callback processing on AFS clients until the fix is delivered. Red Hat's severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVEORG rating of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because exploitation requires a local client that has mounted an AFS share to receive crafted callback traffic from its AFS fileserver peer, which limits exposure in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.