CVE-2026-97585: afs: Fix double-unmap of directory block
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix double-unmap of directory block
Fix afseditdirremove() to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually kunmapping without clearing iter.blocks can result in a double-kunmap if afsdirfindblock() is called twice in a row (which would be the case if the block being modified is not first in the hash chain).
Affected Software
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
The issue is in the Linux kernel AFS code and is relevant to systems using AFS directory operations. The affected path is directory entry removal.
What condition triggers the double unmap?
It can occur when the directory block being modified is not the first block in the hash chain, causing afs_dir_find_block() to be called twice in succession. A manually unmapped block may remain referenced through afs_dir_iter::block and be unmapped again.
Can affected systems be identified by kernel version from the available information?
No affected or fixed kernel version ranges are provided. The supplied references identify commits containing the resolution, so source or package maintenance information must be compared against those commits.