Riskcovery

CVE-2026-72366

netfs: Fix netfs_create_write_req() to handle async cache object creation

State
Published
Severity
9.8 Critical
Published
Aug 15, 2026
Updated
Oct 21, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_create_write_req() to handle async cache object creation

netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped.

Fix this by removing the checks on the cookie and delegating this to fscache_begin_write_operation().

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7b589a9b45ae32aa9d7bece597490e141198d7a6 to before aee03fbc8803a40d65e20f1af816a7219048a426Affected
  • 7b589a9b45ae32aa9d7bece597490e141198d7a6 to before 8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9aAffected
  • 7b589a9b45ae32aa9d7bece597490e141198d7a6 to before 1188a9846fadeacf9d1430b528e5217f749d665bAffected
  • 7b589a9b45ae32aa9d7bece597490e141198d7a6 to before dbd6f56d975b23241b7bbb11bb8f562af548a0aaAffected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.