CVE-2026-72371

CVE-2026-72371 is a 'wrong target' logical error in AFS volume management — the kind of bug that escapes tooling not because the code is broken, but because it does exactly what it says on the surface while accomplishing the wrong thing. When replacing a volume in a cell's volume tree, the code sets the deferred-removal flag on the incoming volume instead of the outgoing one. The tree insertion still succeeds; the failure only manifests later during cleanup as either a double-free or a leak depending on timing. The fix is a one-line swap — change which variable receives the flag assignment. That's the tell. When a bug class produces trivially correctable mistakes rather than requiring structural rework, it signals the underlying design hasn't changed; only this instance was noticed. The real question isn't 'how do we prevent this specific swap' but 'how do we constrain the mutation space so that impossible targets become syntactically unavailable?' This bug survived review and testing precisely because the function performs three operations on two objects in a tight scope: insert new volume, remove old volume, manage deferred cleanup. Under cognitive load, target identification collapses into variable name matching rather than semantic intent. The code was legible — that was the danger. Review caught algorithmic correctness but not target selection. The systemic exposure is worse than the CVSS suggests. AFS is a distributed filesystem; a corrupted volume tree propagates incorrect namespace resolution to every client mounting that cell. The volume replacement path is also a low-frequency operational pattern — it's the kind of legacy code that doesn't get exercised regularly and accumulates mutation risk silently. Each mount/unmount cycle that didn't trigger the bug wasn't evidence of correctness; it was evidence the cleanup path wasn't stressed in the right sequence. Audit the AFS codebase for other dual-object lifecycle transitions using shared flag variables. If similar patterns exist elsewhere, that's a design smell that needs refactoring, not just isolated patches. Consider explicit ownership annotations for volume lifecycle objects so static analyzers can flag assignments to non-owner targets. Review processes should explicitly audit target selection in multi-object mutation functions — not just whether the algorithm is right, but whether the flag is being set on the right object.

Reviewed through automated stages and approved by a human before publication.