Executive brief
The Linux kernel's Andrew File System (AFS) implementation contains a null pointer dereference vulnerability in callback processing. When an AFS server sends a callback for an unknown volume, the kernel fails to validate the volume lookup result, causing a crash that can lead to denial of service on systems using AFS for distributed file sharing.
Technical details
The vulnerability is a missing NULL pointer check in the afs_break_some_callbacks() function in fs/afs/callback.c. The function calls afs_lookup_volume_rcu() to resolve a volume identifier but does not validate whether the returned pointer is NULL before dereferencing it when the specified volume is unknown. This allows a malicious or misbehaving AFS server to trigger a kernel null pointer dereference by sending callback messages for non-existent volumes. The attack requires network reachability to an AFS server and can result in kernel panic and denial of service. The fix adds an explicit NULL check and early return when volume lookup fails.
Affected products
- Linux Linux Kernel multiple versions (see kernel.org stable branches 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-22: patched: Fix committed by David Howells (upstream commit 794a01110390c1b76f59ece773fb0fbfd89c6f5c)
- 2026-07-24: other: Fix included in stable kernel releases