Look up another CVE · open CVE-2026-72373 in the interactive tracker
CVE-2026-72373
afs: Fix missing NULL pointer check in afs_break_some_callbacks()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem fs/afs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72373 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Fix afs_break_some_callbacks() to check to see if afs_lookup_volume_rcu() returned NULL (e.g. the specified volume is unknown).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/afs/callback.c
- What this is
- AFS FILESYSTEMMAINTAINERS section matched on fs/afs/ · linux-afs@lists.infradead.org · Supported
- Kernel module
- kafs
Check it on the machine
grep -w CONFIG_AFS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w kafsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_AFS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.63%, higher than 49.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/afs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.8 | 6.12.97 | a99a61770118 |
| 5.8 | 6.18.40 | 5492799ec5d2 |
| 5.8 | 7.1.5 | e3e59ff22a0d |
| 5.8 | 7.2 | 794a01110390 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached when an AFS fileserver sends a CB.CallBack/YFSCB.CallBack RPC over RxRPC to the kernel cache-manager listener; processing flows through SRXAFSCB_CallBack() to afs_break_some_callbacks() with no local syscall required.
- AC:LAttack complexity, low
- A malicious or compromised fileserver that already has an encrypted RxRPC callback channel can reliably send a volume-level callback break (vnode=0, unique=0) for an arbitrary unknown volume ID, deterministically driving afs_lookup_volume_rcu() to return NULL and crash.
- PR:NPrivileges required, none
- Exploitation requires no privileges on the victim host; a remote peer authenticated as a known AFS fileserver can deliver the crafted callback break without the attacker holding local user, capability, or namespace rights on the client.
- UI:NUser interaction, none
- Once AFS is mounted and a server callback connection exists, triggering the NULL dereference needs no further end-user action—the fileserver can unilaterally send the malformed callback notification at any time.
- S:UScope, unchanged
- Impact is confined to kernel memory in the AFS client callback path (NULL dereference and possible oops/panic); it does not cross a VM, container, or IOMMU security boundary to affect a different authority.
- C:NConfidentiality impact, none
- The failure mode is a NULL pointer dereference on volume->servers in afs_break_volume_callback(); there is no out-of-bounds access, use-after-free, or other memory corruption that could disclose kernel data.
- I:NIntegrity impact, none
- The bug causes an immediate invalid read through a NULL volume pointer and does not provide controlled writes, metadata corruption, or a path to arbitrary code execution beyond crashing the kernel.
- A:HAvailability impact, high
- Hitting afs_break_volume_callback() with a NULL volume dereferences volume->servers under RCU, provoking a kernel oops or panic and denying availability to the entire system until reboot.