{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72374",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-72374"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "afs: Fix callback service message parsers to pass through -EAGAIN",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix callback service message parsers to pass through -EAGAIN\n\nThe AFS filesystem client uses an rxrpc server to listen for callback\nnotifications.  Each callback call type handler has a delivery function\nthat parses the incoming request stream, and this should return -EAGAIN the\nlast packet hasn't yet been seen, but all currently queued received data is\nconsumed.  afs_extract_data() does this, but the -EAGAIN return is switched\nto 0 inadvertantly\n\nFix callback service message parsers to pass through -EAGAIN",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72374"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.5,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - Remote RxRPC traffic to the kafs cache manager on UDP/TCP port 7001 reaches afs_deliver_cb_init_call_back_state3() and afs_deliver_cb_probe_uuid() via rxrpc incoming-call handling (afs_rx_new_call \u2192 afs_deliver_cm_op_id \u2192 afs_cm_incoming_call \u2192 deliver parsers).\nAC:L - An attacker who controls an established callback RxRPC session can reliably force -EAGAIN by fragmenting CB.InitCallBackState3 or CB.ProbeUuid DATA across multiple packets; no special memory layout, races beyond attacker pacing, or rare victim state is required.\nPR:N - No local Linux account or capabilities on the victim are needed; exploitation is driven by a remote RxRPC peer sending fragmented cache-manager callbacks after the encrypted handshake on the callback socket (minimum RXRPC_SECURITY_ENCRYPT).\nUI:N - No victim user action (mounting AFS, opening files, or clicking anything) is required at exploit time; only an active kafs client with its per-net callback listener is needed as deployment context.\nS:U - Impact is confined to kernel/AFS cache-manager state on the victim host (NULL dereference oops, panic, or callback-protocol disruption) and does not cross VM, IOMMU, or sandbox security boundaries.\nC:N - The -EAGAIN mishandling returns success before UUID unmarshalling, leaving call->request NULL; SRXAFSCB_ProbeUuid passes that pointer to memcmp(), causing a kernel fault without attacker-visible disclosure of victim data.\nI:N - The failure mode is premature parser completion and a NULL-pointer memcmp in SRXAFSCB_ProbeUuid (plus possible premature CM replies on InitCallBackState3); no arbitrary kernel write, heap corruption, or code-execution primitive is demonstrated.\nA:H - Treating -EAGAIN as success queues SRXAFSCB_ProbeUuid while call->request is still NULL, and memcmp() on that pointer causes a kernel oops/panic; a remote peer can retrigger this on demand with fragmented CB.ProbeUuid callbacks."
    }
  }
}