Executive brief
The Linux kernel's AFS (Andrew File System) client handles callback notifications from network servers through an rxrpc listener. A logic error in the message parser causes it to incorrectly convert a "not ready yet" signal (-EAGAIN) into a success signal, potentially leading to incomplete message processing, data loss, or service disruption in systems using AFS for network file sharing.
Technical details
This is a logic bug in the AFS callback service message parsers (afs_deliver_cb_init_call_back_state3 and afs_deliver_cb_probe_uuid functions in fs/afs/cmservice.c). The afs_extract_data() function correctly returns -EAGAIN to signal that the last packet has not yet arrived but all queued data has been consumed. However, the callback parser switch statement inadvertently converts this -EAGAIN return to 0 (success), causing incorrect message state handling. The fix removes the erroneous case statement that maps -EAGAIN to 0, allowing the -EAGAIN signal to propagate correctly. No user interaction or authentication is required; the issue affects any AFS client receiving callback notifications. The vulnerability was introduced in commit d001648ec7cf and is fixed by upstream commit 0f36469d7ce98b362934113c550d08bb0c784231.
Affected products
- Linux Linux kernel multiple versions; see kernel.org git history
Timeline
- 2026-08-15: disclosed
- 2026-06-22: patched: upstream fix committed; stable backports followed
- 2026-09-25: other: referenced in stable kernel tree as of this date