Executive brief
The Linux kernel's AFS (Andrew File System) client contains a race condition in how it initializes authentication keys during cell setup. When a user mounts an AFS filesystem, a background thread allocates the required authentication key, but a concurrent lookup may attempt to use that key before it exists, causing a kernel crash (oops). This impacts systems using AFS for network file storage and can lead to service unavailability.
Technical details
The vulnerability is a race condition in the AFS cell initialization code. The anonymous authentication key for a cell is allocated asynchronously in a background thread, but afs_parse_source() triggers afs_lookup_cell() during mount, which then calls request_key() with a key description that may not yet be initialized. The fix allocates a stable reference name at cell creation time, allocates the anonymous key on-demand at the point it is requested (protected by a mutex to prevent race conditions), and makes afs_request_key_rcu() return NULL if the key isn't yet available, allowing the caller to drop out of RCU mode and retry. The attack vector requires local access to trigger a mount operation, and the impact is denial of service (kernel crash).
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2025-12-16: disclosed