HIGH Introduced in 6.8
afs VolumeLookup UAF
CVE-2026-80878
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume Fix afs_lookup_volume_rcu() so that it doesn't leak a dying volume if afs_try_get_volume() fails.
02KernelScan AI Analysis
Risk summary
A memory leak vulnerability in the AFS network filesystem client allows a malicious or compromised AFS server to cause unbounded memory consumption on the client by sending callback notifications. The bug does not enable code execution or information disclosure, but can lead to resource exhaustion and system instability. Products with AFS filesystems mounted and network exposure to an AFS server are at risk.
Vulnerability analysis
The AFS client's volume lookup function fails to release a reference on a volume when that volume is in the process of being destroyed. When the function attempts to acquire a new reference on a dying volume and fails, the stale pointer is returned to the caller without the reference being dropped, causing the volume's memory to leak. The fix ensures the pointer is discarded when reference acquisition fails, so the caller receives nothing instead of a leaked object. This path is reached when a malicious or compromised AFS server sends callback notifications to the client; no client-side privileges are required to trigger this behavior, though the AFS filesystem must be mounted for callback processing to be active.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.110 | 7d10cfec6cbc |
| 6.18 | 6.8 | 6.18.51 | 78e8ee25a5e8 |
| 7.1 | 6.8 | 7.1.5 | 9cabf1c86948 |
| mainline | 6.8 | 7.2 | d672c276f685 |
| cip/6.12 | 6.8 | 6.12.111-cip32 | 7d10cfec6cbc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |