CVE-2026-97585

A flaw was found in the Linux kernel's AFS (Andrew File System) implementation. When removing an entry from an AFS directory, improper tracking of mapped directory blocks can lead to a double unmap operation on the same memory block. A local user could exploit this flaw by performing directory modifications, potentially leading to a Denial of Service (DoS) due to a kernel crash or memory corruption.

A moderate impact flaw was found in the Linux kernel's AFS (Andrew File System) implementation. When removing an entry from an AFS directory, the afs_edit_dir_remove() function manually unmaps a mapped directory block without clearing the iterator state, so if afs_dir_find_block() is called a second time (which happens when the block being modified is not first in the hash chain), the same block can be unmapped twice. A local user with permission to modify an AFS directory can trigger this flaw through directory modification operations, potentially leading to a kernel crash or memory corruption and resulting in a denial of service. Red Hat rates this flaw MODERATE (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no confidentiality or integrity impact has been established.

The vulnerable code is present only in newer kernel streams: Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, and rhel-10.4), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and the OpenShift Container Platform 5.0 RHEL CoreOS 9 kernel are affected. Earlier Red Hat Enterprise Linux versions (including RHEL 6, HEL 7, 8, 9, and RHEL 10.0.z), the real-time (kernel-rt) variants, and the OpenShift 4.x streams are not affected because the code that introduced this flaw is not present in those products. For the affected products the fix is currently deferred and will be delivered in a future update; the residual risk is a local denial of service on systems where AFS filesystems are mounted and unprivileged local users are able to modify AFS directories.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.