CVE-2026-72364

This CVE exposes a flaw in how netfs handles writeback error cleanup — and the problem runs deeper than a single missed function call. When writeback_iter() encounters an I/O error during iteration, it requires the caller to reinvoke the function with the error pointer populated. This second call is what unlocks the current folio, redirties it, and properly unwinds the iteration state. Without it, the folio remains locked and the inode stays out of the writeback cache — corrupting kernel filesystem state in ways that lead to data loss or deadlock under I/O pressure. The CVSS 7.1 is warranted. This isn't a happy-path bug — it triggers only when writeback encounters an error, which is why the EPSS sits at 0.00171. The vulnerability persisted because error handling paths are systematically under-reviewed: reviewers see clean code paths, not obligations that live only in comments or developer memory. What's critical is recognizing the pattern. The contract — 'call the function again with *error set' — is implicit. There's no type system enforcing it, no linter that models iterator cleanup obligations, no test suite that reliably exercises the error path under load. The netfs subsystem itself emerged from consolidating multiple network filesystem implementations, and this two-phase cleanup protocol likely migrated from one original codebase without ever being formalized. That's where implicit contracts go to survive. For defenders: audit every call site to writeback_iter() and enumerate similar iterator-with-cleanup patterns across the kernel. The fix to this CVE is correct, but the design invites the same bug wherever these patterns exist. Static analysis won't save you here — the obligation is architectural, not syntactic. Your best defense is explicit reviewer checklists that flag iterator error paths for two-phase cleanup verification, and systematic pattern indexing across subsystems to catch the next instance before it merges.

Reviewed through automated stages and approved by a human before publication.