Executive brief
The Andrew File System (AFS) implementation in the Linux kernel contains a race condition in how it manages cell metadata. Multiple concurrent processes could access or modify the same cell data structure without proper synchronization, potentially causing data corruption, denial of service, or unpredictable kernel behavior. This affects systems that mount AFS filesystems.
Technical details
The vulnerability is a race condition (lack of synchronization) in the AFS cell management code. Specifically, modifications to the net->cells_dyn_ino inode database were not protected by the cells_lock mutex, allowing concurrent threads to race when allocating, removing, or accessing cell structures. The fix involves taking the cells_lock exclusively during idr_alloc_cyclic() and idr_remove() operations, and moving the idr_remove() call from the RCU cleanup context (afs_cell_destroy) to the asynchronous worker context (afs_destroy_cell_work) where sleeping locks can be safely acquired. This is a local privilege escalation vector requiring unprivileged user interaction with AFS mounts.
Affected products
- Linux Linux kernel Multiple versions through 2026 (see upstream fix reference 1d0b929fc070)
Timeline
- 2026-08-15: disclosed
- 2026-06-22: patched: Upstream fix authored; stable backports followed
- 2026-07-24: other: Fix entered stable kernel trees