CVE-2026-72366 netfs: Fix netfs_create_write_req() to handle async cache object creation
A logic error in the Linux kernel netfs subsystem could skip cache operations during async creation, potentially affecting performance or consistency.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72366?
CVE-2026-72366 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_create_write_req() to handle async cache object creation
netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped.
Fix this by removing the checks on the cookie and delegating this to fscache_begin_write_operation().
Which versions are affected by CVE-2026-72366?
How do I fix CVE-2026-72366?
Apply the vendor's patch.
Is CVE-2026-72366 being exploited?
There is no known exploitation of CVE-2026-72366 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72366, DEBIAN-CVE-2026-72366, GHSA-8q2x-69cw-5m48, UBUNTU-CVE-2026-72366.