Executive brief
The Linux kernel's AFS (Andrew File System) module handles security challenges via out-of-band (OOB) messages in network communications. A bug in the OOB message processing handler could leave background work tasks running after shutdown, potentially causing system instability or resource leaks. This fix ensures proper cancellation of these tasks when the network namespace closes.
Technical details
The vulnerability exists in the AFS rxrpc OOB message handler (fs/afs/rxrpc.c and fs/afs/cm_security.c), where out-of-band messages used for security challenge responses were not being properly cancelled during socket closure. The root cause is that work items scheduled via schedule_work() were not explicitly cancelled, and the OOB handler lacked a check for a closed network namespace. The fix adds two cancel_work_sync() calls in afs_close_socket() to ensure pending OOB work is completed, moves OOB processing to the afs_wq workqueue, and adds a READ_ONCE(net->live) check in afs_rx_notify_oob() to prevent scheduling work after namespace shutdown. This is a resource management fix rather than a direct security vulnerability, affecting systems using AFS over rxrpc.
Affected products
- Linux Linux kernel 5.0 and later (backported to stable branches)
Timeline
- 2026-09-04: disclosed: CVE-2026-80885 published on NVD
- 2026-06-24: patched: Fix committed upstream by David Howells
- 2026-07-24: other: Backported to stable trees by Greg Kroah-Hartman