SB2026081604 - Improper Initialization in Linux kernel netfs

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-72366)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource initialization in netfs_create_write_req() when handling write operations during asynchronous cache object creation. A local user can trigger a write operation before the fscache cookie is fully enabled to cause a denial of service.

The issue occurs because caching may be skipped while asynchronous cache object creation has not progressed far enough for the cookie to be enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1188a9846fadeacf9d1430b528e5217f749d665b
• https://git.kernel.org/stable/c/8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a
• https://git.kernel.org/stable/c/dbd6f56d975b23241b7bbb11bb8f562af548a0aa