Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-72166
Published: August 16, 2026
Vulnerability identifier: #VU143427
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72166
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.
The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.
Affected software
Linux kernel
How to mitigate CVE-2026-72166
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/378481cc60a937ef8ea4ef6e4f95f0dbc4e21414
- https://git.kernel.org/stable/c/4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8
- https://git.kernel.org/stable/c/6b4f48728faa8bb514368f7eacda05565dea8696
- https://git.kernel.org/stable/c/823886a1b089b49bcd349bc8bd3417b7910cd1ac
- https://git.kernel.org/stable/c/a8874c34c4a973f9922908a4b8be1d1278f01e42
- https://git.kernel.org/stable/c/dc892cbb1e4341d427b1f940ebd6abd69bf8e479
- https://git.kernel.org/stable/c/f62a1f245a71680033260a6f6d74011cc3acb3cd