afs: Clear stale peer app data after address list changes
Summary
| CVE | CVE-2026-97583 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-25 11:17:09 UTC |
|---|
| Updated | 2026-09-25 11:17:09 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
afs: Clear stale peer app data after address list changes
afs_fs_probe_fileserver() fetches the current endpoint state under
server->fs_lock, but leaves old_alist as NULL. Consequently,
afs_set_peer_appdata() treats every address list replacement as initial
setup and only binds the new peers; it never unbinds peers removed from
the old list.
An address refresh can therefore proceed as follows. CPU 0 replaces
server S's list and drops Pold without clearing Pold->app_data. The
server destroyer then clears only S's current peers and lets S reach its
RCU callback. After the callback frees S, CPU 1 handles a callback
through an RxRPC connection that still pins Pold, reads Pold->app_data,
and calls afs_use_server() on the freed object.
KASAN reported:
BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0
Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74
Call Trace:
afs_find_server+0x3c/0xa0
afs_rx_new_call+0x15c/0x390
rxrpc_new_incoming_call+0x97c/0x1730
rxrpc_input_packet.constprop.0+0xd03/0xec0
rxrpc_io_thread+0x967/0x1640
Allocated by task 93:
afs_lookup_server+0x1a7/0x14c0
afs_alloc_server_list+0x43f/0xb60
afs_create_volume+0x923/0x1490
afs_get_tree+0x1c6/0x10a0
Freed by task 0:
kfree+0x131/0x3c0
rcu_core+0x50a/0x1850
Last potentially related work creation:
__call_rcu_common.constprop.0+0x71/0xa10
afs_put_server+0x213/0x2b0
Preserve old->addresses for the peer app-data update so that removed
peers are cleared before the endpoint state is replaced. Also advance
both cursors when the old and new lists share a peer; activating the
old/new comparison without this would otherwise loop forever on the
shared entry. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 39ba6af83a7f9dee3e6a7916f41a48bcbda54eba 3afb988fd0411707bdafb9b321086fff0da28aae git |
Not specified |
| CNA |
Linux |
Linux |
affected 40e8b52fe8c8ab6920ea5f59c5469b6918cce624 c7f77a11a1e719192c7262aad38a3919aec62c21 git |
Not specified |
| CNA |
Linux |
Linux |
affected 40e8b52fe8c8ab6920ea5f59c5469b6918cce624 7f7f5589d048821dea316cbac9b37d27eaf7530e git |
Not specified |
| CNA |
Linux |
Linux |
affected 40e8b52fe8c8ab6920ea5f59c5469b6918cce624 ba0623fc19a424f4745394c499f9f28a8d88d397 git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.12.101 6.12.111 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.15 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.15 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.111 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.53 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.7 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/7f7f5589d048821dea316cbac9b37d27eaf7530e |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/ba0623fc19a424f4745394c499f9f28a8d88d397 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/c7f77a11a1e719192c7262aad38a3919aec62c21 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/3afb988fd0411707bdafb9b321086fff0da28aae |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.