CVE-2026-97583

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97583", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.156Z", "datePublished": "2026-09-25T10:22:03.666Z", "dateUpdated": "2026-10-19T09:09:46.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:46.971Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Clear stale peer app data after address list changes\n\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver->fs_lock, but leaves old_alist as NULL. Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\n\nAn address refresh can therefore proceed as follows. CPU 0 replaces\nserver S's list and drops Pold without clearing Pold->app_data. The\nserver destroyer then clears only S's current peers and lets S reach its\nRCU callback. After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,\nand calls afs_use_server() on the freed object.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\n Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\n Call Trace:\n afs_find_server+0x3c/0xa0\n afs_rx_new_call+0x15c/0x390\n rxrpc_new_incoming_call+0x97c/0x1730\n rxrpc_input_packet.constprop.0+0xd03/0xec0\n rxrpc_io_thread+0x967/0x1640\n Allocated by task 93:\n afs_lookup_server+0x1a7/0x14c0\n afs_alloc_server_list+0x43f/0xb60\n afs_create_volume+0x923/0x1490\n afs_get_tree+0x1c6/0x10a0\n Freed by task 0:\n kfree+0x131/0x3c0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __call_rcu_common.constprop.0+0x71/0xa10\n afs_put_server+0x213/0x2b0\n\nPreserve old->addresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced. Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote cell operator supplies the changed fileserver address list in the VL address-lookup reply (afs_vl_lookup_addrs -> afs_fs_probe_fileserver). A later incoming RxRPC call over UDP from a dropped peer reaches afs_rx_new_call -> afs_find_server, which dereferences the freed server through the stale peer app_data.\nAC:H - Triggering needs a specific order of events: the client refreshes the server's address list and gets a new version, then the server record goes unused and is freed by afs_server_destroyer after the GC delay, while an RxRPC connection still holds the old peer. Only then does a new incoming call hit it. The refresh and teardown timing follow the client's own activity, not the attacker's.\nPR:N - The VL reply and the incoming cache-manager call that reaches afs_rx_new_call/afs_find_server are handled before any server identity check. The attacker needs no account on the victim host.\nUI:R - The victim must have mounted, or be actively using, a volume from the attacker's AFS cell so that afs_lookup_server and afs_update_server_record run against the attacker's VL server. AFS mounts are not user-namespace mountable.\nS:U - The use-after-free happens in the kernel AFS client's afs_server object and stays within the kernel's own security authority. No VM, sandbox or IOMMU boundary is crossed.\nC:H - afs_use_server() works on a freed kmalloc'd afs_server reached through the stale peer app_data. If that slab is reclaimed, fields the attacker controls are read as server state, including pointers, which can leak kernel memory.\nI:H - afs_use_server() increments the active counter, and the call path then takes references and queues work on the freed afs_server. Writing into a reallocated object gives a memory-corruption primitive that could be used to hijack control flow.\nA:H - A slab use-after-free in the krxrpcio I/O thread (see the KASAN report in the commit) can oops or panic the kernel and bring down all AFS and RxRPC service on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/addr_list.c", "fs/afs/fs_probe.c"], "versions": [{"version": "39ba6af83a7f9dee3e6a7916f41a48bcbda54eba", "lessThan": "3afb988fd0411707bdafb9b321086fff0da28aae", "status": "affected", "versionType": "git"}, {"version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "lessThan": "c7f77a11a1e719192c7262aad38a3919aec62c21", "status": "affected", "versionType": "git"}, {"version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "lessThan": "7f7f5589d048821dea316cbac9b37d27eaf7530e", "status": "affected", "versionType": "git"}, {"version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "lessThan": "ba0623fc19a424f4745394c499f9f28a8d88d397", "status": "affected", "versionType": "git"}, {"version": "6.12.101", "lessThan": "6.12.111", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/addr_list.c", "fs/afs/fs_probe.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.101", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3afb988fd0411707bdafb9b321086fff0da28aae"}, {"url": "https://git.kernel.org/stable/c/c7f77a11a1e719192c7262aad38a3919aec62c21"}, {"url": "https://git.kernel.org/stable/c/7f7f5589d048821dea316cbac9b37d27eaf7530e"}, {"url": "https://git.kernel.org/stable/c/ba0623fc19a424f4745394c499f9f28a8d88d397"}], "title": "afs: Clear stale peer app data after address list changes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/addr_list.c", "fs/afs/fs_probe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3afb988fd0411707bdafb9b321086fff0da28aae", "status": "affected", "version": "39ba6af83a7f9dee3e6a7916f41a48bcbda54eba", "versionType": "git"}, {"lessThan": "c7f77a11a1e719192c7262aad38a3919aec62c21", "status": "affected", "version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "versionType": "git"}, {"lessThan": "7f7f5589d048821dea316cbac9b37d27eaf7530e", "status": "affected", "version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "versionType": "git"}, {"lessThan": "ba0623fc19a424f4745394c499f9f28a8d88d397", "status": "affected", "version": "40e8b52fe8c8ab6920ea5f59c5469b6918cce624", "versionType": "git"}, {"lessThan": "6.12.111", "status": "affected", "version": "6.12.101", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/addr_list.c", "fs/afs/fs_probe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Clear stale peer app data after address list changes\n\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver->fs_lock, but leaves old_alist as NULL. Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\n\nAn address refresh can therefore proceed as follows. CPU 0 replaces\nserver S's list and drops Pold without clearing Pold->app_data. The\nserver destroyer then clears only S's current peers and lets S reach its\nRCU callback. After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,\nand calls afs_use_server() on the freed object.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\n Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\n Call Trace:\n afs_find_server+0x3c/0xa0\n afs_rx_new_call+0x15c/0x390\n rxrpc_new_incoming_call+0x97c/0x1730\n rxrpc_input_packet.constprop.0+0xd03/0xec0\n rxrpc_io_thread+0x967/0x1640\n Allocated by task 93:\n afs_lookup_server+0x1a7/0x14c0\n afs_alloc_server_list+0x43f/0xb60\n afs_create_volume+0x923/0x1490\n afs_get_tree+0x1c6/0x10a0\n Freed by task 0:\n kfree+0x131/0x3c0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __call_rcu_common.constprop.0+0x71/0xa10\n afs_put_server+0x213/0x2b0\n\nPreserve old->addresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced. Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry."}], "id": "CVE-2026-97583", "lastModified": "2026-10-19T10:17:27.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:09.127", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3afb988fd0411707bdafb9b321086fff0da28aae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f7f5589d048821dea316cbac9b37d27eaf7530e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba0623fc19a424f4745394c499f9f28a8d88d397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c7f77a11a1e719192c7262aad38a3919aec62c21"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: Clear stale peer app data after address list changes", "id": "2541046", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541046"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nafs: Clear stale peer app data after address list changes\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver->fs_lock, but leaves old_alist as NULL. Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\nAn address refresh can therefore proceed as follows. CPU 0 replaces\nserver S's list and drops Pold without clearing Pold->app_data. The\nserver destroyer then clears only S's current peers and lets S reach its\nRCU callback. After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,\nand calls afs_use_server() on the freed object.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\nRead of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\nCall Trace:\nafs_find_server+0x3c/0xa0\nafs_rx_new_call+0x15c/0x390\nrxrpc_new_incoming_call+0x97c/0x1730\nrxrpc_input_packet.constprop.0+0xd03/0xec0\nrxrpc_io_thread+0x967/0x1640\nAllocated by task 93:\nafs_lookup_server+0x1a7/0x14c0\nafs_alloc_server_list+0x43f/0xb60\nafs_create_volume+0x923/0x1490\nafs_get_tree+0x1c6/0x10a0\nFreed by task 0:\nkfree+0x131/0x3c0\nrcu_core+0x50a/0x1850\nLast potentially related work creation:\n__call_rcu_common.constprop.0+0x71/0xa10\nafs_put_server+0x213/0x2b0\nPreserve old->addresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced. Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry.", "A flaw was found in the Linux kernel's AFS (Andrew File System) client. During server address list refreshes, removed network peers fail to have their associated application data cleared. A network attacker or remote file server can exploit this by sending incoming network callbacks that reference the stale peer, causing the system to access previously freed server memory. This issue leads to a use-after-free condition that can result in a kernel crash and a Denial of Service (DoS)."], "name": "CVE-2026-97583", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97583\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97583\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97583.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39ba6af83a7f9dee3e6a7916f41a48bcbda54eba,3afb988fd0411707bdafb9b321086fff0da28aae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[40e8b52fe8c8ab6920ea5f59c5469b6918cce624,c7f77a11a1e719192c7262aad38a3919aec62c21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[40e8b52fe8c8ab6920ea5f59c5469b6918cce624,7f7f5589d048821dea316cbac9b37d27eaf7530e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[40e8b52fe8c8ab6920ea5f59c5469b6918cce624,ba0623fc19a424f4745394c499f9f28a8d88d397)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.101,6.12.111)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T18:15:15.769388+00:00", "updated": "2026-10-01T09:15:06.347247+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-825"]}