Strix
56.5K

CVE-2026-72374

HIGHCVSS 7.5/10EPSS 0.22%

Last modified

CVE-2026-72374 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.22%

12.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 26b737b3769e92493fe94c34620399d93ca231ae; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 09c67a7ded481482155b836c8c7f078a3075f8de; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 772850871a2e772e26f9d93f1e9ddd413b3eeaa4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 0acbc09d2aca0432af45cec114f20d55ceafaec4; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < f14dd036fad3d359f26f1282199cec06b3a9362b; >= d001648ec7cf8b21ae9eec8b9ba4a18295adfb14, < 0f36469d7ce98b362934113c550d08bb0c784231
LinuxLinux4.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72374?
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN
How severe is CVE-2026-72374?
CVE-2026-72374 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72374?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72374?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST