CVE-2026-97583

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

afs: Clear stale peer app data after address list changes

afs_fs_probe_fileserver() fetches the current endpoint state under

server->fs_lock, but leaves old_alist as NULL. Consequently,

afs_set_peer_appdata() treats every address list replacement as initial

setup and only binds the new peers; it never unbinds peers removed from

the old list.

An address refresh can therefore proceed as follows. CPU 0 replaces

server S's list and drops Pold without clearing Pold->app_data. The

server destroyer then clears only S's current peers and lets S reach its

RCU callback. After the callback frees S, CPU 1 handles a callback

through an RxRPC connection that still pins Pold, reads Pold->app_data,

and calls afs_use_server() on the freed object.

KASAN reported:

BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0

Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74

Call Trace:

afs_find_server+0x3c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References