CVE-2026-72375 Linux CVE debrief

Who should care

Linux kernel maintainers, users of the afs module, and administrators of systems running the affected kernel versions should be aware of this vulnerability and take necessary actions to patch their systems. The vulnerability has a significant impact on the Linux kernel, and users should prioritize assessment and patching of the affected systems. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated to ensure proper mitigation.

Technical summary

The CVE-2026-72375 vulnerability is related to the Andrew File System (afs) module in the Linux kernel. The issue arises from the insufficient initialization of work_structs in the slab's init function, specifically with the afs_vnode::lock_work. This leads to a warning from the DEBUG_OBJECTS debugging mechanism when running tests like generic/131 xfstest. The fix involves reinitializing ->lock_work after allocating an inode and flushing ->lock_work when the inode is being evicted. The vulnerability has a significant impact on the Linux kernel, and users should prioritize assessment and patching of the affected systems.

Defensive priority

Linux kernel maintainers and users should prioritize assessment and patching of the affected systems.

Recommended defensive actions

• Review and apply the provided patches to ensure the afs module is properly handling inode initialization and lock_work.
• Run the generic/131 xfstest to verify the fix.
• Monitor system logs for any signs of the DEBUG_OBJECTS warning.
• Perform a thorough review of the affected systems to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE is related to a vulnerability in the Linux kernel, specifically in the afs (Andrew File System) module. The issue is with the reinitialization of the inode's lock_work. The problem arises because initializing work_structs only once in the slab's init function is not sufficient. This results in a warning from the DEBUG_OBJECTS debugging mechanism when running certain tests.

Official resources