CVE-2026-72377

A flaw was found in the Linux kernel's Andrew File System (AFS) module. When fscache is enabled, AFS symlinks and mountpoints are incorrectly handled during memory management operations. This can lead to a pointer dereference, which a local attacker could potentially exploit to cause a system crash, resulting in a Denial of Service (DoS).

A moderate flaw was found in the Linux kernel's Andrew File System (AFS) module. When fscache is enabled, afs_apply_status() unconditionally sets the AS_RELEASE_ALWAYS flag on the address spaces of AFS symlinks and mountpoints, even though these objects use address_space_operations (afs_dir_aops) that do not provide a release_folio callback. When kernel memory management subsequently attempts to release such a folio, filemap_release_folio() falls through to try_to_free_buffers(), which expects buffer_heads to be non-NULL; because symlinks and mountpoints have no buffer_heads, this causes a NULL pointer dereference that crashes the kernel. A local attacker with access to a system with an AFS filesystem mounted and fscache enabled could exploit this flaw to cause a denial of service.

This issue affects the kernel and kernel-ivos-qualcomm components in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, which contain the change that enabled caching of AFS symlinks. A fix is currently deferred for these streams, so the residual risk remains a local denial of service affecting system availability only, with no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, 8, 9, and 10.0 do not contain the vulnerable code and are therefore not affected. Red Hat rates this flaw moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.