CVE-2026-72368

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix double unlock in nomem_d_alloc error path

When start_creating() fails and returns -ENOMEM, it has already

released the parent directory lock in __start_dirop():

static struct dentry *__start_dirop(...)

{

...

inode_lock_nested(dir, I_MUTEX_PARENT);

dentry = lookup_one_qstr_excl(name, parent, lookup_flags);

if (IS_ERR(dentry))

inode_unlock(dir); <-- Lock released on error

return dentry;

}

However, the nomem_d_alloc error path in cachefiles_get_directory()

unconditionally calls inode_unlock(d_inode(dir)) again, causing a

double unlock that corrupts the rwsem state.

This is a leftover from commit 7ab96df840e60 which replaced manual

locking with start_creating() but failed to update the nomem_d_alloc

path (while correctly updating mkdir_error and lookup_error paths).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References