CVE-2026-97585

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97585", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.156Z", "datePublished": "2026-09-25T10:22:04.942Z", "dateUpdated": "2026-10-19T09:09:48.929Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:48.929Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix double-unmap of directory block\n\nFix afs_edit_dir_remove() to use a cleanup function to unmap the block\npointed to by afs_dir_iter::block if it's left pointing to something rather\nthan manually kunmapping the blocks. Manually kunmapping without clearing\niter.blocks can result in a double-kunmap if afs_dir_find_block() is called\ntwice in a row (which would be the case if the block being modified is not\nfirst in the hash chain)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/dir_edit.c", "fs/afs/dir_search.c", "fs/afs/internal.h"], "versions": [{"version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "lessThan": "9d6c703e24da3d39067e3c75f4ac2f6001c2472f", "status": "affected", "versionType": "git"}, {"version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "lessThan": "b60f51e4ad0f6f940899788ccc2762db1e3b69e6", "status": "affected", "versionType": "git"}, {"version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "lessThan": "e3cfd3eb7d5be7787cc69530b423f788f14d084f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/dir_edit.c", "fs/afs/dir_search.c", "fs/afs/internal.h"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9d6c703e24da3d39067e3c75f4ac2f6001c2472f"}, {"url": "https://git.kernel.org/stable/c/b60f51e4ad0f6f940899788ccc2762db1e3b69e6"}, {"url": "https://git.kernel.org/stable/c/e3cfd3eb7d5be7787cc69530b423f788f14d084f"}], "title": "afs: Fix double-unmap of directory block", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/dir_edit.c", "fs/afs/dir_search.c", "fs/afs/internal.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9d6c703e24da3d39067e3c75f4ac2f6001c2472f", "status": "affected", "version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "versionType": "git"}, {"lessThan": "b60f51e4ad0f6f940899788ccc2762db1e3b69e6", "status": "affected", "version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "versionType": "git"}, {"lessThan": "e3cfd3eb7d5be7787cc69530b423f788f14d084f", "status": "affected", "version": "a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/dir_edit.c", "fs/afs/dir_search.c", "fs/afs/internal.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix double-unmap of directory block\n\nFix afs_edit_dir_remove() to use a cleanup function to unmap the block\npointed to by afs_dir_iter::block if it's left pointing to something rather\nthan manually kunmapping the blocks. Manually kunmapping without clearing\niter.blocks can result in a double-kunmap if afs_dir_find_block() is called\ntwice in a row (which would be the case if the block being modified is not\nfirst in the hash chain)."}], "id": "CVE-2026-97585", "lastModified": "2026-10-19T10:17:27.910", "metrics": {}, "published": "2026-09-25T11:17:09.657", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d6c703e24da3d39067e3c75f4ac2f6001c2472f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b60f51e4ad0f6f940899788ccc2762db1e3b69e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3cfd3eb7d5be7787cc69530b423f788f14d084f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: Fix double-unmap of directory block", "id": "2541089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541089"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nafs: Fix double-unmap of directory block\nFix afs_edit_dir_remove() to use a cleanup function to unmap the block\npointed to by afs_dir_iter::block if it's left pointing to something rather\nthan manually kunmapping the blocks. Manually kunmapping without clearing\niter.blocks can result in a double-kunmap if afs_dir_find_block() is called\ntwice in a row (which would be the case if the block being modified is not\nfirst in the hash chain).", "A flaw was found in the Linux kernel's AFS (Andrew File System) implementation. When removing an entry from an AFS directory, improper tracking of mapped directory blocks can lead to a double unmap operation on the same memory block. A local user could exploit this flaw by performing directory modifications, potentially leading to a Denial of Service (DoS) due to a kernel crash or memory corruption."], "name": "CVE-2026-97585", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97585\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97585\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97585.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e,9d6c703e24da3d39067e3c75f4ac2f6001c2472f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e,b60f51e4ad0f6f940899788ccc2762db1e3b69e6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5b5beebcf96d5e8a2fc79856c2ac1e93f82478e,e3cfd3eb7d5be7787cc69530b423f788f14d084f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:15:10.541749+00:00", "updated": "2026-10-01T09:30:05.890016+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}