Executive brief
The Linux kernel's AFS (Andrew File System) implementation contains a memory leak in the volume lookup routine. When the system fails to acquire a reference to a volume during callback processing, it does not properly clean up the volume object, causing memory to remain allocated and unavailable for other uses. This can lead to gradual memory exhaustion on systems using AFS, potentially causing service degradation or crashes.
Technical details
This is a resource management vulnerability in the AFS filesystem code, specifically in the afs_lookup_volume_rcu() function in fs/afs/callback.c. The vulnerable code attempts to get a volume reference via afs_try_get_volume(), but when that call fails, the function does not clear the volume pointer before retrying. This leaves a reference to the dying volume object that is never released, causing a memory leak. The fix is minimal: add a single line (volume = NULL;) to clear the pointer when afs_try_get_volume() fails. The vulnerability has no authentication or network preconditions—it can be triggered through normal AFS volume lookups during callback processing. Patches are available in Linux kernel stable trees and have been backported across multiple kernel versions.
Affected products
- Linux Linux kernel Multiple versions (patched across kernel 2.6.11 through 7.2)
Timeline
- 2026-09-04: disclosed: CVE-2026-80878 published
- 2026-06-22: patched: Upstream fix committed by David Howells