vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72371

afs: Fix the volume AFS_VOLUME_RM_TREE is set on

HIGH
7.8
CVSS Score
Published: August 15, 2026 at 05:56 AM UTC
Updated: October 16, 2026 at 07:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS_VOLUME_RM_TREE is set on Fix afs_insert_volume_into_cell() to set AFS_VOLUME_RM_TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be removed from the tree twice and the new volume never to be removed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5.15.1466.1.706.6.96.798fb5eaade749e9d366fdd1f622d560ad68bdedd9a6b294ab496650e9f270123730df37030911b559b4c95a63e2dfe5ea73d92fb82ec34c3efa76284c3215484ca1f64b6b8af03847856499e5364e65a
Vendor states this is fixed in 158c5a0b1dfc0e6a419efe18404047a4d2dff59e (fixed)
Vendor states this is fixed in 1607075220cf57161d9116512994c159eacefc0d (fixed)
Vendor states this is fixed in 56b4e4b26f84411d880f968a539207b0a8889c8c (fixed)
Vendor states this is fixed in 6fa9a8a73e16aa22fce6e41cc00d59c767f0a540 (fixed)
Vendor states this is fixed in c421bc6b957e56e45e12dbaeaf70a60db20d6465 (fixed)
Vendor states this is fixed in d0c8ad418b47891a03426c5e02ebb0537f8d68f8 (fixed)
Vendor states this is fixed in d154c20837f379343f192d4b8d9dd4ef145562e6 (fixed)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (7)

Source: cverecord
https://git.kernel.org/stable/c/6fa9a8a73e16aa22fce6e41cc00d59c767f0a540
Source: cverecord
https://git.kernel.org/stable/c/c421bc6b957e56e45e12dbaeaf70a60db20d6465
Source: cverecord
https://git.kernel.org/stable/c/1607075220cf57161d9116512994c159eacefc0d
Source: cverecord
https://git.kernel.org/stable/c/d154c20837f379343f192d4b8d9dd4ef145562e6
Source: cverecord
https://git.kernel.org/stable/c/158c5a0b1dfc0e6a419efe18404047a4d2dff59e
Source: cverecord
https://git.kernel.org/stable/c/d0c8ad418b47891a03426c5e02ebb0537f8d68f8
Source: cverecord
https://git.kernel.org/stable/c/56b4e4b26f84411d880f968a539207b0a8889c8c

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card