1. Home
  2. Vulnerabilities
  3. CVE-2026-72170
7.8
HIGH CVSS 3.1
CVE-2026-72170
9p: skip nlink update in cacheless mode to fix WARN_ON
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARN_ON v9fs_dec_count() unconditionally calls drop_nlink() on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the server (the source of truth) on every operation, so by the time v9fs_remove() returns, the locally cached nlink may already reflect the post-unlink value: 1. Client initiates unlink, server processes it and sets nlink to 0 2. Client refetches inode metadata (nlink=0) before unlink returns 3. Client's v9fs_remove() completes successfully 4. Client calls v9fs_dec_count() which calls drop_nlink() on nlink=0 This race is easily triggered under heavy unlink workloads, such as stress-ng's unlink stressor, producing the following warning: WARNING: fs/inode.c:417 at drop_nlink+0x4c/0xc8 Call trace: drop_nlink+0x4c/0xc8 v9fs_remove+0x1e0/0x250 [9p] v9fs_vfs_unlink+0x20/0x38 [9p] vfs_unlink+0x13c/0x258 ... In cacheless mode the server is authoritative and the inode is on its way out, so locally adjusting nlink buys nothing. Skip v9fs_dec_count() entirely when neither CACHE_META nor CACHE_LOOSE is set, which both avoids the warning and removes a class of nlink races (two concurrent unlinkers observing nlink > 0 and both calling drop_nlink()) that an nlink == 0 guard alone would only narrow rather than close.

Details
INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72170 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Kernel fix prevents nlink race condition in cacheless 9p mode.
  • Update the Linux kernel to the latest version.
  • Apply the specific patch for the 9p module.
  • Avoid heavy unlink workloads in cacheless mode.
  • Verify inode nlink values after operations.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72170.

URL Resource
https://git.kernel.org/stable/c/574aa0b4799470ac814479f1138d19efe6262255
https://git.kernel.org/stable/c/8d610017c992de705b304d3d727a6e3a86af6149
https://git.kernel.org/stable/c/8faccac11e1369adddf5d80f4a45af93f13b2e1a
https://git.kernel.org/stable/c/a5a682b016ef5b5384e28f6d652d47a8f8e73d37
https://git.kernel.org/stable/c/de79c3f3643841b8659a71958df7cf2a66bfd409
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72170 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72170 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72170 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72170 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'a5a682b016ef5b5384e28f6d652d47a8f8e73d37', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'de79c3f3643841b8659a71958df7cf2a66bfd409', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8d610017c992de705b304d3d727a6e3a86af6149', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8faccac11e1369adddf5d80f4a45af93f13b2e1a', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '574aa0b4799470ac814479f1138d19efe6262255', 'versionType': 'git'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'a5a682b016ef5b5384e28f6d652d47a8f8e73d37', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'de79c3f3643841b8659a71958df7cf2a66bfd409', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8d610017c992de705b304d3d727a6e3a86af6149', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8faccac11e1369adddf5d80f4a45af93f13b2e1a', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '574aa0b4799470ac814479f1138d19efe6262255', 'versionType': 'git'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'a5a682b016ef5b5384e28f6d652d47a8f8e73d37', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': 'de79c3f3643841b8659a71958df7cf2a66bfd409', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8d610017c992de705b304d3d727a6e3a86af6149', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '8faccac11e1369adddf5d80f4a45af93f13b2e1a', 'versionType': 'git'}, {'status': 'affected', 'version': 'ac89b2ef9b55924bcf922251f043ba73a32d05bb', 'lessThan': '574aa0b4799470ac814479f1138d19efe6262255', 'versionType': 'git'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/9p/vfs_inode.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARN_ON v9fs_dec_count() unconditionally calls drop_nlink() on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the server (the source of truth) on every operation, so by the time v9fs_remove() returns, the locally cached nlink may already reflect the post-unlink value: 1. Client initiates unlink, server processes it and sets nlink to 0 2. Client refetches inode metadata (nlink=0) before unlink returns 3. Client's v9fs_remove() completes successfully 4. Client calls v9fs_dec_count() which calls drop_nlink() on nlink=0 This race is easily triggered under heavy unlink workloads, such as stress-ng's unlink stressor, producing the following warning: WARNING: fs/inode.c:417 at drop_nlink+0x4c/0xc8 Call trace: drop_nlink+0x4c/0xc8 v9fs_remove+0x1e0/0x250 [9p] v9fs_vfs_unlink+0x20/0x38 [9p] vfs_unlink+0x13c/0x258 ... In cacheless mode the server is authoritative and the inode is on its way out, so locally adjusting nlink buys nothing. Skip v9fs_dec_count() entirely when neither CACHE_META nor CACHE_LOOSE is set, which both avoids the warning and removes a class of nlink races (two concurrent unlinkers observing nlink > 0 and both calling drop_nlink()) that an nlink == 0 guard alone would only narrow rather than close.
    Added Reference https://git.kernel.org/stable/c/574aa0b4799470ac814479f1138d19efe6262255
    Added Reference https://git.kernel.org/stable/c/8d610017c992de705b304d3d727a6e3a86af6149
    Added Reference https://git.kernel.org/stable/c/8faccac11e1369adddf5d80f4a45af93f13b2e1a
    Added Reference https://git.kernel.org/stable/c/a5a682b016ef5b5384e28f6d652d47a8f8e73d37
    Added Reference https://git.kernel.org/stable/c/de79c3f3643841b8659a71958df7cf2a66bfd409
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact