{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97583","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-24T16:01:01.156Z","datePublished":"2026-09-25T10:22:03.666Z","dateUpdated":"2026-09-25T14:41:24.604Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-25T14:41:24.604Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Clear stale peer app data after address list changes\n\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver->fs_lock, but leaves old_alist as NULL.  Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\n\nAn address refresh can therefore proceed as follows.  CPU 0 replaces\nserver S's list and drops Pold without clearing Pold->app_data.  The\nserver destroyer then clears only S's current peers and lets S reach its\nRCU callback.  After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,\nand calls afs_use_server() on the freed object.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\n  Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\n  Call Trace:\n   afs_find_server+0x3c/0xa0\n   afs_rx_new_call+0x15c/0x390\n   rxrpc_new_incoming_call+0x97c/0x1730\n   rxrpc_input_packet.constprop.0+0xd03/0xec0\n   rxrpc_io_thread+0x967/0x1640\n  Allocated by task 93:\n   afs_lookup_server+0x1a7/0x14c0\n   afs_alloc_server_list+0x43f/0xb60\n   afs_create_volume+0x923/0x1490\n   afs_get_tree+0x1c6/0x10a0\n  Freed by task 0:\n   kfree+0x131/0x3c0\n   rcu_core+0x50a/0x1850\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x71/0xa10\n   afs_put_server+0x213/0x2b0\n\nPreserve old->addresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced.  Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - A remote cell operator supplies the changed fileserver address list in the VL address-lookup reply (afs_vl_lookup_addrs -> afs_fs_probe_fileserver). A later incoming RxRPC call over UDP from a dropped peer reaches afs_rx_new_call -> afs_find_server, which dereferences the freed server through the stale peer app_data.\nAC:H - Triggering needs a specific order of events: the client refreshes the server's address list and gets a new version, then the server record goes unused and is freed by afs_server_destroyer after the GC delay, while an RxRPC connection still holds the old peer. Only then does a new incoming call hit it. The refresh and teardown timing follow the client's own activity, not the attacker's.\nPR:N - The VL reply and the incoming cache-manager call that reaches afs_rx_new_call/afs_find_server are handled before any server identity check. The attacker needs no account on the victim host.\nUI:R - The victim must have mounted, or be actively using, a volume from the attacker's AFS cell so that afs_lookup_server and afs_update_server_record run against the attacker's VL server. AFS mounts are not user-namespace mountable.\nS:U - The use-after-free happens in the kernel AFS client's afs_server object and stays within the kernel's own security authority. No VM, sandbox or IOMMU boundary is crossed.\nC:H - afs_use_server() works on a freed kmalloc'd afs_server reached through the stale peer app_data. If that slab is reclaimed, fields the attacker controls are read as server state, including pointers, which can leak kernel memory.\nI:H - afs_use_server() increments the active counter, and the call path then takes references and queues work on the freed afs_server. Writing into a reallocated object gives a memory-corruption primitive that could be used to hijack control flow.\nA:H - A slab use-after-free in the krxrpcio I/O thread (see the KASAN report in the commit) can oops or panic the kernel and bring down all AFS and RxRPC service on the host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/addr_list.c","fs/afs/fs_probe.c"],"versions":[{"version":"39ba6af83a7f9dee3e6a7916f41a48bcbda54eba","lessThan":"3afb988fd0411707bdafb9b321086fff0da28aae","status":"affected","versionType":"git"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"c7f77a11a1e719192c7262aad38a3919aec62c21","status":"affected","versionType":"git"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"7f7f5589d048821dea316cbac9b37d27eaf7530e","status":"affected","versionType":"git"},{"version":"40e8b52fe8c8ab6920ea5f59c5469b6918cce624","lessThan":"ba0623fc19a424f4745394c499f9f28a8d88d397","status":"affected","versionType":"git"},{"version":"6.12.101","lessThan":"6.12.111","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/addr_list.c","fs/afs/fs_probe.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.101","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.3-rc3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3afb988fd0411707bdafb9b321086fff0da28aae"},{"url":"https://git.kernel.org/stable/c/c7f77a11a1e719192c7262aad38a3919aec62c21"},{"url":"https://git.kernel.org/stable/c/7f7f5589d048821dea316cbac9b37d27eaf7530e"},{"url":"https://git.kernel.org/stable/c/ba0623fc19a424f4745394c499f9f28a8d88d397"}],"title":"afs: Clear stale peer app data after address list changes","x_generator":{"engine":"bippy-1.2.0"}}}}