CVE-2026-72368 cachefiles: Fix double unlock in nomem_d_alloc error path
A double unlock in the Linux kernel cachefiles module can corrupt lock state, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72368?
CVE-2026-72368 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix double unlock in nomem_d_alloc error path
When start_creating() fails and returns -ENOMEM, it has already released the parent directory lock in __start_dirop():
static struct dentry *__start_dirop(...) { ... inode_lock_nested(dir, I_MUTEX_PARENT); dentry = lookup_one_qstr_excl(name, parent, lookup_flags); if (IS_ERR(dentry)) inode_unlock(dir); <-- Lock released on error return dentry; }
However, the nomem_d_alloc error path in cachefiles_get_directory() unconditionally calls inode_unlock(d_inode(dir)) again, causing a double unlock that corrupts the rwsem state.
This is a leftover from commit 7ab96df840e60 which replaced manual locking with start_creating() but failed to update the nomem_d_alloc path (while correctly updating mkdir_error and lookup_error paths).
Which versions are affected by CVE-2026-72368?
How do I fix CVE-2026-72368?
Apply the vendor's patch.
Is CVE-2026-72368 being exploited?
There is no known exploitation of CVE-2026-72368 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-72368, GHSA-h4x8-g6jq-m2w5, UBUNTU-CVE-2026-72368.