CVE-2026-97583

A flaw was found in the Linux kernel's AFS (Andrew File System) client. During server address list refreshes, removed network peers fail to have their associated application data cleared. A network attacker or remote file server can exploit this by sending incoming network callbacks that reference the stale peer, causing the system to access previously freed server memory. This issue leads to a use-after-free condition that can result in a kernel crash and a Denial of Service (DoS).

This vulnerability is rated Moderate severity for Red Hat because exploitation requires the in-kernel AFS filesystem client to be loaded and actively communicating with remote servers during address list refreshes, limiting exposure to specialized deployments. In typical Red Hat Enterprise Linux installations, the AFS kernel module is not loaded by default, substantially reducing the unauthenticated attack surface. An attacker or rogue peer must trigger specific timing conditions during server address re-probing to induce a use-after-free crash, restricting the blast radius in most enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.