CVE-2026-72375

A moderate-impact flaw was found in the Linux kernel AFS (Andrew File System) client shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The afs_vnode::lock_work delayed work object is initialised only once in the slab constructor instead of being reinitialised each time an inode is allocated, and it is not flushed when an inode is evicted. As a result, the work_struct can be queued in an improper state during file-locking operations on AFS files (for example via fcntl()), which triggers kernel DEBUG_OBJECTS warnings and can lead to system instability. A local user able to perform file-locking operations on an AFS mount could exploit this flaw to cause a denial of service. Red Hat rated the impact as moderate because the demonstrated consequence is limited to availability (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the higher upstream CVEORG score of 7.8 additionally assumes high confidentiality and integrity impact, which the available evidence does not establish. Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams the fix is deferred: the issue manifests as a debug warning and potential instability under specific local AFS file-locking workloads rather than a demonstrated privilege-escalation or memory-corruption exploit, so it will be addressed in a future planned update. Until then, the residual risk is a local denial of service on systems that actively use AFS filesystems.