CVE-2026-72368

CVE-2026-72368 is a double-unlock vulnerability in the cachefiles module where a refactoring commit (7ab96df840e60) replaced manual rwsem locking with a start_creating() wrapper but failed to update all error exit paths. The function correctly handles error paths for mkdir_error and lookup_error, but the nomem_d_alloc path was missed — when -ENOMEM occurs, the code attempts to unlock an already-released semaphore, leaving rwsem state corrupted. The critical insight here is that this is a refactoring failure, not a simple coding mistake. The commit's implicit claim of completeness — replacing manual locking 'without qualifiers' — masked an incomplete mental model of the error taxonomy. Three error paths were consciously updated; one was absent from the author's taxonomy of what 'replaced manual locking' meant. This asymmetry is the tell: the developer knew error paths existed and handled some, but believed nomem_d_alloc didn't require the same treatment. The EPSS score of 0.00165 reflects trigger difficulty, not bounded impact. Exploiting this requires start_creating() to fail with -ENOMEM specifically — a condition indicating system distress — during a narrow cachefiles initialization window. However, the blast radius of rwsem state corruption is not constrained to cachefiles. Subsequent acquires or releases along any path touching that inode could deadlock, race, or corrupt memory in ways unrelated to the original subsystem. For defenders: prioritize patching in environments where cachefiles runs (typically secondary storage caching), but recognize that the theoretical severity justifies urgency despite low EPSS. The kernel lacks automated lock-state verification across all exit paths — this class of error recurs because refactoring commits changing lock semantics receive the same review scrutiny as mechanical code moves, yet the damage potential is identical to an intentional bug. Consider whether your patch process treats 'refactoring miss' differently from logic bugs; the blast radius doesn't care about intent.

Reviewed through automated stages and approved by a human before publication.