CVE-2026-72379: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-xpvr-4r6x-x86m
Share
Published
Advisory Summary

CVE-2026-72379 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72379 at a Glance

CVE Identifier CVE-2026-72379
GHSA Identifier GHSA-xpvr-4r6x-x86m
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-72379

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72379, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1. Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold. Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().

References

NVD — CVE-2026-72379 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72379
git.kernel.org/stable/c/47e434da47... WEB
https://git.kernel.org/stable/c/47e434da476b5a8bcd1e6e52ab03c5ee7764ee78
git.kernel.org/stable/c/503d0568a5... WEB
https://git.kernel.org/stable/c/503d0568a525b168d9aa5ca046ec72fc5477df84
git.kernel.org/stable/c/539dce1144... WEB
https://git.kernel.org/stable/c/539dce1144651f7976fa418e618b0b574bf15eeb
git.kernel.org/stable/c/a2038514e6... WEB
https://git.kernel.org/stable/c/a2038514e69371eb493083a6a897ed20fcbb8acb
git.kernel.org/stable/c/bac8fb0d60... WEB
https://git.kernel.org/stable/c/bac8fb0d60254846f3b56957435dcd870ae12948

Frequently Asked Questions

What is CVE-2026-72379?
CVE-2026-72379 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72379?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-72379?
CVE-2026-72379 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72379?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xpvr-4r6x-x86m",
  "modified" : "2026-08-15T06:32:22Z",
  "published" : "2026-08-15T06:32:22Z",
  "aliases" : [ "CVE-2026-72379" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid\n\nvfs_tmpfile() never checked that the caller's fsuid and fsgid map into\nthe filesystem.  On an idmapped mount whose idmapping does not cover the\ncaller's fs{u,g}id, the ->tmpfile() instance initializes the new inode\nthrough inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return\nINVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1.\n\nEvery other creation path already refuses this: may_o_create() (O_CREAT)\nand may_create_dentry() (mkdir, mknod, symlink, link) bail out with\n-EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot\nbe created with an owner the filesystem cannot represent.  An O_TMPFILE\nis no exception: it is created I_LINKABLE and linkat(2) can splice it\ninto the namespace afterwards, so the same guarantee must hold.\n\nAdd the missing fsuidgid_has_mapping() check to vfs_tmpfile().  On a\nnon-idmapped mount the caller's fs{u,g}id always map in the superblock's\nuser namespace, so this is a no-op there and only takes effect on an\nidmapped mount that does not map the caller.  It applies to every\nfilesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs,\next4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer\ntmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72379"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/47e434da476b5a8bcd1e6e52ab03c5ee7764ee78"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/503d0568a525b168d9aa5ca046ec72fc5477df84"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/539dce1144651f7976fa418e618b0b574bf15eeb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a2038514e69371eb493083a6a897ed20fcbb8acb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bac8fb0d60254846f3b56957435dcd870ae12948"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:11Z"
  }
}