{"cve":"CVE-2026-72375","nvd":{"published":"2026-08-15T06:22:10.987","modified":"2026-10-21T13:19:36.203","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix reinitialisation of the inode, in particular ->lock_work\n\nIt seems that initalising afs_vnode::lock_work a single time in the slab's\ninit function isn't sufficient for work_structs.  This results in the\nDEBUG_OBJECTS debugging stuff producing a warning occasionally when running\nthe generic/131 xfstest:\n\n ODEBUG: activate not available (active state 0) object: 0000000016d8760f object type: work_struct hint: afs_lock_work+0x0/0x220\n WARNING: lib/debugobjects.c:629 at debug_print_object+0x4b/0x90, CPU#3: locktest/7695\n ...\n CPU: 3 UID: 0 PID: 7695 Comm: locktest Tainted: G S                  7.1.0-build3+ #2771 PREEMPT\n ...\n RIP: 0010:debug_print_object+0x65/0x90\n ...\n Call Trace:\n  <TASK>\n  ? __pfx_afs_lock_work+0x10/0x10\n  debug_object_activate+0x122/0x170\n  insert_work+0x25/0x60\n  __queue_work+0x2e0/0x340\n  queue_delayed_work_on+0x48/0x70\n  afs_fl_release_private+0x57/0x70\n  locks_release_private+0x5c/0xa0\n  locks_free_lock+0xe/0x20\n  posix_lock_inode+0x55f/0x5b0\n  locks_lock_inode_wait+0x81/0x140\n  ? file_write_and_wait_range+0x50/0x70\n  afs_lock+0xcd/0x110\n  fcntl_setlk+0x10d/0x260\n  do_fcntl+0x24e/0x5b0\n  __do_sys_fcntl+0x6a/0x90\n  do_syscall_64+0x11e/0x310\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nFix this by reinitialising ->lock_work after allocating an inode.\n\nAlso, flush ->lock_work when the inode is being evicted to make sure it's\nnot still running.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/2e7888bb635d9bc84359491347b236cc232ca4df","https://git.kernel.org/stable/c/34dff35154e2fb3987ec5e0b40def14c64eadeb1","https://git.kernel.org/stable/c/5597fbd1e7c161914f20315a726e54025b0fdadb","https://git.kernel.org/stable/c/63d3f283858fae097fb09ddd4ce46bb0bc1f9d01","https://git.kernel.org/stable/c/ebfd13c0367adb43d7c0a72f5cd7e004e60c6b28"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-72375","score":0.00175,"percentile":0.06956,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}