HIGH Introduced in 6.14
afs DirBlock UAF
CVE-2026-97585
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afs_edit_dir_remove() to use a cleanup function to unmap the block pointed to by afs_dir_iter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually kunmapping without clearing iter.blocks can result in a double-kunmap if afs_dir_find_block() is called twice in a row (which would be the case if the block being modified is not first in the hash chain).
02KernelScan AI Analysis
Risk summary
A local user with write access to a mounted AFS filesystem directory can trigger a double-unmap of a kernel mapping, corrupting the kernel's per-task mapping table. This can be exploited for memory corruption, potentially leading to privilege escalation or denial of service.
Vulnerability analysis
The AFS directory editing code releases a mapped directory block but fails to clear the internal record of that mapping. When the code later needs to examine another block in the same hash chain—which occurs when removing a directory entry that is not the first in its bucket—the stale record causes the same block to be released again, corrupting the kernel's mapping tracking. The fix replaces the scattered manual release operations with a single cleanup routine that always releases the block and resets the internal record together, preventing any mismatch. Any local user with write access to a directory on a mounted AFS filesystem can reach this by deleting a file that is not the first entry in its hash bucket.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.53 | 9d6c703e24da |
| 7.2 | 6.14 | 7.2.7 | b60f51e4ad0f |
| mainline | 6.14 | 7.3 | e3cfd3eb7d5b |