CVE-2026-72374

HighCVSS 7.5/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix callback service message parsers to pass through -EAGAIN

The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly

Fix callback service message parsers to pass through -EAGAIN

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 26b737b3769e92493fe94c34620399d93ca231ae; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 09c67a7ded481482155b836c8c7f078a3075f8de; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 772850871a2e772e26f9d93f1e9ddd413b3eeaa4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 0acbc09d2aca0432af45cec114f20d55ceafaec4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < f14dd036fad3d359f26f1282199cec06b3a9362b; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 0f36469d7ce98b362934113c550d08bb0c784231
LinuxLinux4.9

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-723757.8In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular ->lock_work It sCVE-2026-72376In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net->cells_outstanding Fix net->cells_outstaCVE-2026-72377In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints CVE-2026-723787.5In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs_extract_vl_addrs() The error codes on theseCVE-2026-72379In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfCVE-2026-72384.7A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.pCVE-2026-723808.8In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req_id before indexing rsp[] pvcalCVE-2026-723819.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp->owner.name in durable handle owner cheCVE-2026-723828.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limitsCVE-2026-723837.8In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr_wq_timer race in sctp_free_addr_wq() sctp_free_addr_wq(CVE-2026-72384In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The drivCVE-2026-72385In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
CVE-2026-72374: High severity, CVSS 7.5 | Vulnix