Executive brief
The Linux kernel's Andrew File System (AFS) implementation contains a logic error in cell allocation where a reference counter is incremented before validation checks are performed. If the validation fails, the counter remains incorrectly incremented, causing a resource leak that prevents proper cleanup and tracking of AFS cell objects.
Technical details
The vulnerability is a reference counting error in fs/afs/cell.c where net->cells_outstanding is atomically incremented before the idr_alloc_cyclic() call that can fail. If idr_alloc_cyclic() returns an error, the function jumps to an error handler but the counter remains incremented, leaving the outstanding cell count in an inconsistent state. This is an ordering bug (CWE-691) introduced in commit 88c853c3f5c0. The fix moves the atomic_inc() call to occur only after successful allocation. No network access or authentication is required to trigger this; it affects local kernel state management. The patch has been applied to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-4.x through linux-7.x)
Timeline
- 2026-08-15: disclosed
- 2026-06-22: patched: Fix committed upstream