CVE-2026-72376 afs: Fix misplaced inc of net->cells_outstanding
A logic error in the Linux kernel AFS module incorrectly increments a counter on allocation failure, potentially leading to resource exhaustion or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72376?
CVE-2026-72376 is a vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix misplaced inc of net->cells_outstanding
Fix net->cells_outstanding being incremented before the check for failure of idr_alloc_cyclic(), leaving the count incremented on error.
Which versions are affected by CVE-2026-72376?
How do I fix CVE-2026-72376?
Apply the vendor's patch.
Is CVE-2026-72376 being exploited?
There is no known exploitation of CVE-2026-72376 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72376, DEBIAN-CVE-2026-72376, GHSA-3q83-ffw9-5j7c, UBUNTU-CVE-2026-72376.