## Summary
CVE-2026-72371 is a Linux kernel AFS (Andrew File System) volume-tree bug where the AFS_VOLUME_RM_TREE flag is set on the wrong afs_volume during afs_insert_volume_into_cell(). This can lead to incorrect removal behavior in the volume red-black tree, including double-removal of the old volume and failure to remove the new one.
## Technical Details
The fix changes afs_insert_volume_into_cell(struct afs_cell *cell, ...) in fs/afs/volume.c so that AFS_VOLUME_RM_TREE is set on the *replaced* volume (p), not on the newly inserted volume (volume).
- Problem behavior (pre-fix): set_bit(AFS_VOLUME_RM_TREE, &volume->flags); while replacing an existing node via rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);.
- Correct behavior (post-fix): set_bit(AFS_VOLUME_RM_TREE, &p->flags);.
- Rationale from the patch: setting the flag on the new volume (which is removed from the cell’s volume tree) causes the old volume to be removed from the tree twice, while the new volume never gets removed.
- The patch references a prior issue: “Fixes: 9a6b294ab496 ("afs: Fix use-after-free due to get/remove race in volume tree")”.
## Affected
- Linux kernel AFS volume management code in fs/afs/volume.c (function afs_insert_volume_into_cell()).
- Affected versions are not explicitly listed in the provided references; remediation corresponds to the stable commits containing the one-line flag correction.
## Impact
Given the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the patch rationale, the issue can result in memory safety and integrity/availability failures in the AFS volume tree, including double removal and stale tree membership.
## Mitigation
1. Apply the upstream/stable kernel patch that changes set_bit(AFS_VOLUME_RM_TREE, &volume->flags); to set_bit(AFS_VOLUME_RM_TREE, &p->flags); in fs/afs/volume.c within afs_insert_volume_into_cell().
2. Ensure the running kernel includes the fix corresponding to the referenced commits (e.g., 56b4e4b26f84411d880f968a539207b0a8889c8c and stable variants shown in the references).
3. If you cannot patch immediately, reduce exposure by limiting local access to systems mounting/using AFS, since the CVSS indicates local, low-complexity, low-privilege conditions (AV:L, AC:L, PR:L, UI:N).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H