CVE-2026-72377

In the Linux kernel, the following vulnerability has been resolved:

afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints

Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled (set via afsvnodesetcache()). Symlinks and mountpoints in AFS use afsdiraops, which does not provide a releasefolio callback. However, afsapplystatus() unconditionally calls mappingsetreleasealways() for these.

In such case when memory management code attempts to release folios, filemapreleasefolio() checks folioneedsrelease() which returns true due to ASRELEASEALWAYS being set. Since there is no releasefolio callback, it falls through to trytofreebuffers(), which at present expects bufferheads to be not null. For symlinks and mountpoints without bufferheads, this causes pointer dereference.

[dh: Added more bits that were missed]