Executive brief
The Linux kernel's AFS (Andrew File System) component contains a bug in error handling within the VL address extraction function. When processing multiple address records in a loop, error codes are not properly set on every iteration, potentially causing misleading or missing error information to be returned to callers. This could result in systems misinterpreting the failure reason when AFS volume location lookups encounter malformed data.
Technical details
The vulnerability is a logic error in the afs_extract_vl_addrs() function (fs/afs/vl_list.c). The function initializes an error variable only once before entering a loop, but subsequent iterations through the loop that encounter error conditions (e.g., malformed IPv4 or IPv6 address data) do not properly set the return error code before jumping to the error handler. This means callers receive stale or uninitialized error codes, corrupting error reporting. The fix adds explicit error code assignments (ret = -EINVAL) at each error path within the loop. The vulnerability affects AFS lookups on systems using the kernel's AFS client; no authentication or special privileges are required to trigger it through malformed VL server responses.
Affected products
- Linux Linux kernel affected kernels from 2.6.11 through at least 6.9 (AFS subsystem introduced in 0a5143f2f89c)
Timeline
- 2026-08-15: disclosed
- 2026-07-01: patched: upstream patch committed