CVE-2026-72377
afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
Description
In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs_file_aops which have release_folio set as netfs_release_folio, so AS_RELEASE_ALWAYS is valid for them when fscache is enabled (set via afs_vnode_set_cache()). Symlinks and mountpoints in AFS use afs_dir_aops, which does not provide a release_folio callback. However, afs_apply_status() unconditionally calls mapping_set_release_always() for these. In such case when memory management code attempts to release folios, filemap_release_folio() checks folio_needs_release() which returns true due to AS_RELEASE_ALWAYS being set. Since there is no release_folio callback, it falls through to try_to_free_buffers(), which at present expects buffer_heads to be not null. For symlinks and mountpoints without buffer_heads, this causes pointer dereference. [dh: Added more bits that were missed]
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel.
- Apply vendor patches for AFS module.
- Verify correct AFS configuration.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72377.
| URL | Resource |
|---|---|
| https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459 | |
| https://git.kernel.org/stable/c/9d6b0f6d437e2f8350e08678e5e1d20c11c364f3 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72377 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72377
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72377 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72377 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '9d6b0f6d437e2f8350e08678e5e1d20c11c364f3', 'versionType': 'git'}, {'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459', 'versionType': 'git'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '9d6b0f6d437e2f8350e08678e5e1d20c11c364f3', 'versionType': 'git'}, {'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459', 'versionType': 'git'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '9d6b0f6d437e2f8350e08678e5e1d20c11c364f3', 'versionType': 'git'}, {'status': 'affected', 'version': 'eae9e78951bb02a7b94a9adef6e981413d13c564', 'lessThan': '81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459', 'versionType': 'git'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/afs/inode.c', 'fs/afs/internal.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs_file_aops which have release_folio set as netfs_release_folio, so AS_RELEASE_ALWAYS is valid for them when fscache is enabled (set via afs_vnode_set_cache()). Symlinks and mountpoints in AFS use afs_dir_aops, which does not provide a release_folio callback. However, afs_apply_status() unconditionally calls mapping_set_release_always() for these. In such case when memory management code attempts to release folios, filemap_release_folio() checks folio_needs_release() which returns true due to AS_RELEASE_ALWAYS being set. Since there is no release_folio callback, it falls through to try_to_free_buffers(), which at present expects buffer_heads to be not null. For symlinks and mountpoints without buffer_heads, this causes pointer dereference. [dh: Added more bits that were missed] Added Reference https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459 Added Reference https://git.kernel.org/stable/c/9d6b0f6d437e2f8350e08678e5e1d20c11c364f3