High 7.5Published Aug 15, 2026

CVE-2026-72374afs: Fix callback service message parsers to pass through -EAGAIN

Updated under an hour ago (Oct 27, 2026, 4:20 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 26b737b3769e92493fe94c34620399d93ca231ae; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 09c67a7ded481482155b836c8c7f078a3075f8de; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 239cd337c9d047e7097f5b2ebbb41ddfb8180bc6; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 5a39b145a8fb49f316e7ec1f29ba51d68095c7e4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 772850871a2e772e26f9d93f1e9ddd413b3eeaa4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 0acbc09d2aca0432af45cec114f20d55ceafaec4; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before f14dd036fad3d359f26f1282199cec06b3a9362b; from d001648ec7cf8b21ae9eec8b9ba4a18295adfb14 before 0f36469d7ce98b362934113c550d08bb0c784231	CNA record

References

References

https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae
https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de
https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6
https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4
https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4
https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4
https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b
https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.