Executive brief
The Linux kernel's AFS (Andrew File System) filesystem module contains a flag-setting bug in the volume insertion logic. When replacing a volume in the cell's volume tree, the code incorrectly marks the new volume for tree removal instead of the old volume being replaced, causing the old volume to be removed twice and the new volume never to be properly cleaned up. This could lead to memory corruption or denial of service on systems using AFS.
Technical details
The vulnerability is a logic error in the afs_insert_volume_into_cell() function in fs/afs/volume.c. The code sets the AFS_VOLUME_RM_TREE flag on the new volume being inserted (variable 'volume') rather than on the replaced volume (variable 'p'). This causes the old volume to be removed from the tree twice while the new volume is never removed, leading to a use-after-free condition and potential memory safety issues. The fix is a one-line change: swap the flag-setting target from 'volume->flags' to 'p->flags'. No authentication or network access is required to trigger this—any operation that causes volume replacement in the AFS cell's tree can exploit this. Patches have been available since July 2026.
Affected products
- Linux Linux kernel multiple versions prior to 2026-07-24
Timeline
- 2026-08-15: disclosed: CVE-2026-72371 published
- 2026-07-24: patched: Fix merged into Linux kernel stable trees
- 2026-06-22: other: Upstream commit 56b4e4b26f84411d880f968a539207b0a8889c8c authored