Executive brief
The Linux kernel's AFS (Andrew File System) client contains a memory leak in the afs_update_cell() function. When updating the list of AFS volume location servers, memory is not properly freed under specific conditions (when the new server list is empty). This can cause gradual memory exhaustion on systems using AFS, potentially leading to performance degradation or crashes.
Technical details
This is a memory leak vulnerability in the AFS filesystem code (fs/afs/cell.c) in the afs_update_cell() function. The root cause occurs when afs_update_cell() allocates a new volume location server list (vllist), but if that list is empty (nr_servers == 0) and the old list is not empty, the newly allocated list is not properly freed before being discarded. The vulnerable code path assigns the new empty vllist to a temporary variable but fails to ensure proper cleanup. The fix adds an else clause to correctly assign the new vllist to the 'old' variable so it is properly released via afs_put_vlserverlist(). No authentication or special privileges are required to trigger this leak; it can occur during normal AFS cell updates. Patches are available across Linux stable branches.
Affected products
- Linux Linux kernel Multiple versions (patch available in stable branches)
Timeline
- 2026-09-04: disclosed
- 2026-06-22: patched: Upstream fix date