CVE-2026-72374

A MODERATE severity flaw was found in the Linux kernel's AFS filesystem client as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The AFS client listens for callback notifications on an rxrpc server, and the delivery functions that parse incoming callback request streams incorrectly convert the -EAGAIN return value from afs_extract_data() to 0 when the last packet of a message has not yet been received but all currently queued data has been consumed. As a result, an incomplete callback message can be treated as successfully parsed, causing protocol state confusion. A malicious or compromised AFS fileserver, or an attacker able to tamper with AFS callback traffic, could exploit this by sending a partial callback message to a client that has mounted an AFS share, leading to a denial of service of AFS client callback processing; there is no evidence of memory corruption or privilege escalation, and the impact is limited to availability. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, while Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Because this is a moderate, availability-only issue whose exposure is limited to systems actually using the AFS filesystem, the fix has been deferred to a future update of the affected streams; the residual risk is potential disruption of AFS callback processing on AFS clients until the fix is delivered. Red Hat's severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVEORG rating of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because exploitation requires a local client that has mounted an AFS share to receive crafted callback traffic from its AFS fileserver peer, which limits exposure in typical Red Hat deployments.