Executive brief
The Linux kernel's Andrew File System (AFS) implementation contains a null pointer dereference vulnerability when handling symbolic links and mount points. When the kernel attempts to release memory pages for AFS symlinks or mountpoints, a missing callback function causes the code to dereference a null pointer, potentially leading to a kernel crash or denial of service.
Technical details
The vulnerability is a null pointer dereference in the AFS (Andrew File System) subsystem. The root cause: AFS symlinks and mountpoints use afs_dir_aops address space operations, which lack a release_folio callback. However, the afs_apply_status() function unconditionally sets the AS_RELEASE_ALWAYS flag for these objects via mapping_set_release_always(). When memory pressure triggers folio release, filemap_release_folio() checks folio_needs_release() (which returns true), then falls through to try_to_free_buffers() expecting non-null buffer_heads. For symlinks and mountpoints without buffer_heads, this causes a null pointer dereference. The fix removes the inappropriate AS_RELEASE_ALWAYS setting for non-file AFS objects and makes netfs context initialization conditional on file type. Local access to AFS mountpoints is required; no network or authentication bypass is involved.
Affected products
- Linux Linux kernel multiple versions (see kernel git history for affected releases)
Timeline
- 2026-08-15: disclosed
- 2026-07-01: patched