CVE-2026-72374

afs: Fix callback service message parsers to pass through -EAGAIN

State: Published
Severity: 7.5 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix callback service message parsers to pass through -EAGAIN

The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly

Fix callback service message parsers to pass through -EAGAIN

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 26b737b3769e92493fe94c34620399d93ca231aeAffected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 09c67a7ded481482155b836c8c7f078a3075f8deAffected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6Affected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4Affected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 772850871a2e772e26f9d93f1e9ddd413b3eeaa4Affected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 0acbc09d2aca0432af45cec114f20d55ceafaec4Affected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before f14dd036fad3d359f26f1282199cec06b3a9362bAffected d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 0f36469d7ce98b362934113c550d08bb0c784231Affected
LinuxLinux	4.9Affected before 4.9Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 26b737b3769e92493fe94c34620399d93ca231aeAffected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 09c67a7ded481482155b836c8c7f078a3075f8deAffected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6Affected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4Affected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 772850871a2e772e26f9d93f1e9ddd413b3eeaa4Affected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 0acbc09d2aca0432af45cec114f20d55ceafaec4Affected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before f14dd036fad3d359f26f1282199cec06b3a9362bAffected
d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 to before 0f36469d7ce98b362934113c550d08bb0c784231Affected

LinuxLinux

4.9Affected
before 4.9Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.