CVE-2026-72472 Linux CVE debrief

Who should care

System administrators and users of Linux systems with NFS configurations should apply kernel updates to prevent potential use-after-free issues with file locks. They should also review and update NFS configurations, and monitor system logs for potential issues.

Technical summary

The Linux kernel vulnerability CVE-2026-72472 was addressed by using nfsi->rwsem to protect traversal of the file lock list, preventing use-after-free problems with file locks in NFS. The fix involves modifying the nfs_reclaim_locks function and moving the call to locks_lock_inode_wait into _nfs4_proc_setlk. This change helps prevent use-after-free problems with file locks in NFS. The fix also helps to prevent deadlocks that could occur when adding protection. The bug fixed by commit c69899a17ca4 has been resolved after commit 0460253913e5 because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path.

Defensive priority

Apply kernel updates to prevent potential use-after-free issues with file locks in NFS.

Recommended defensive actions

• Apply kernel updates
• Review and update NFS configurations
• Monitor system logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of kernel source code and documentation may be necessary to fully understand the issue. The fix involves modifying the nfs_reclaim_locks function and moving the call to locks_lock_inode_wait into _nfs4_proc_setlk. This change helps prevent use-after-free problems with file locks in NFS. System administrators should review the official advisory and CVE record for more details.

Official resources