HIGH Introduced in 6.16
afs OobHandler UAF
CVE-2026-80885
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing (typically to respond to security challenges). Also move OOB message processing to afs_wq so that it's also waited for and make the OOB handler just return if the net namespace is no longer live.
02KernelScan AI Analysis
Risk summary
A malicious or compromised AFS file server can send out-of-band security challenge messages to a client. If the client tears down its AFS network namespace while OOB message processing work is still pending, the work handler accesses freed net namespace structures, resulting in a use-after-free. This can lead to kernel memory corruption, privilege escalation, or a system crash. Any system that mounts AFS filesystems from untrusted or potentially compromised servers is at risk.
Vulnerability analysis
When an AFS file server sends an out-of-band security challenge, the client schedules a work item to process it on the system workqueue. During network namespace teardown, this work is not cancelled, so it can continue running after the namespace's socket and associated resources have already been freed, causing a use-after-free on the net namespace object. The fix moves OOB work scheduling onto the AFS workqueue that is properly flushed during teardown, adds explicit cancellation of the OOB work item in the socket close path, and guards both the scheduling and processing loops with a check on whether the namespace is still live. The vulnerability is reachable from a remote AFS server sending challenge messages to a client that has mounted a filesystem from that server; no client-side privileges are required beyond the ability to mount and unmount AFS volumes.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.40 | 231414253b64 |
| mainline | 6.16 | 7.2 | a4057e58b070 |
| 7.1 | 6.16 | 7.1.5 | d14e96ddd616 |