CVE-2026-97583

Status: UPDATED  |  Advisory ID: CVE-2026-97583

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

afs: Clear stale peer app data after address list changes

afs_fs_probe_fileserver() fetches the current endpoint state under

server->fs_lock, but leaves old_alist as NULL. Consequently,

afs_set_peer_appdata() treats every address list replacement as initial

setup and only binds the new peers; it never unbinds peers removed from

the old list.

An address refresh can therefore proceed as follows. CPU 0 replaces

server S's list and drops Pold without clearing Pold->app_data. The

server destroyer then clears only S's current peers and lets S reach its

RCU callback. After the callback frees S, CPU 1 handles a callback

through an RxRPC connection that still pins Pold, reads Pold->app_data,

and calls afs_use_server() on the freed object.

KASAN reported:

BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0

Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74

Call Trace:

afs_find_server+0x3c/0xa0

afs_rx_new_call+0x15c/0x390

rxrpc_new_incoming_call+0x97c/0x1730

rxrpc_input_packet.constprop.0+0xd03/0xec0

rxrpc_io_thread+0x967/0x1640

Allocated by task 93:

afs_lookup_server+0x1a7/0x14c0

afs_alloc_server_list+0x43f/0xb60

afs_create_volume+0x923/0x1490

afs_get_tree+0x1c6/0x10a0

Freed by task 0:

kfree+0x131/0x3c0

rcu_core+0x50a/0x1850

Last potentially related work creation:

__call_rcu_common.constprop.0+0x71/0xa10

afs_put_server+0x213/0x2b0

Preserve old->addresses for the peer app-data update so that removed

peers are cleared before the endpoint state is replaced. Also advance

both cursors when the old and new lists share a peer; activating the

old/new comparison without this would otherwise loop forever on the

shared entry. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References