Description

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there's a race with async call reception and destruction. If a call is dispatched that doesn't have call->write_iter set (used to specify the data content for FS.StoreData), then the first rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr. Once rxrpc_send_data() queues the last request packet, the response could come in at any time and cause the call to be completed and put. However, afs_make_call() will look at the call again to see it ->write_iter should be handled - something it's only allowed to do if it has its own ref on the call. Whilst this is the case for synchronous calls, it isn't true for async calls such as FS.FetchData. There's also a potential UAF in afs_make_call() in the event that an asynchronous call is being sent, but the call fails in some way (e.g. it gets aborted from the server). The problem there is that afs_make_call() tries to abort a call if the rxrpc send fails, but the asynchronous notification from rxrpc may have caused the afs_call to be torn down. generic/650 plays games with randomly taking CPUs offline, and can interject a significant delay such that the call is deallocated before afs_make_call() gets to check call->write_iter - and a UAF ensues (caught by KASAN). BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs] Read of size 8 at addr ffff888035e050e8 by task fsstress/1409 Fix this by making afs_make_op_call() give the op->call its own ref rather than transferring the caller's ref to it and then dropping the ref when afs_make_call() returns. This also means that the afs_make_call() func never loses its ref on the call now.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:55.630Z",
  "pubdate": "2026-08-15T13:17:55.630Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel AFS network filesystem client implementation, specifically within the afs_make_call() function. This flaw arises from a race condition between asynchronous call transmission, response reception, and resource destruction. When handling asynchronous calls such as FS.FetchData, the rxrpc subsystem can process responses and complete the call concurrently with the execution flow of afs_make_call(). If the call is deallocated before the transmitting function completes its post-send evaluations—such as checking call->write_iter or attempting to abort a failed transmission—a use-after-free condition occurs. This vulnerability can be triggered locally, potentially leading to kernel panics, denial of service, or arbitrary memory corruption. Exploitation typically requires local execution capabilities or specific timing conditions, which can be exacerbated by CPU throttling or heavy system load, as demonstrated by test suites like generic/650.",
  "technicalDetails": "The vulnerability resides in the afs_make_call() function within the Linux kernel's AFS filesystem driver (kafs). The root cause is improper reference counting management for afs_call structures during asynchronous network operations. Specifically, when an asynchronous call is dispatched via rxrpc_kernel_send_data() without setting MSG_MORE, the transmission of the final request packet allows incoming responses to be processed immediately by the rxrpc layer.\nOnce the response is received, rxrpc can complete and release the call object at any time. However, afs_make_call() attempts to perform subsequent logic on the call object—such as evaluating call->write_iter or issuing an abort via rxrpc_kernel_abort_call() upon send failures—without holding a guaranteed reference to the structure. For synchronous calls, a dedicated reference is maintained, but asynchronous calls previously transferred or dropped references prematurely, leaving a window where the call pointer becomes dangling.\nAttack flow begins when an attacker or local process initiates an AFS operation that results in an asynchronous call (e.g., FS.FetchData). Under specific timing conditions, CPU scheduling delays, or race-inducing states (such as taking CPUs offline dynamically), the background rxrpc worker thread completes the request and deallocates the underlying slab cache memory for the afs_call structure before the original execution context in afs_make_call() evaluates member variables. When afs_make_call() subsequently attempts a memory read access on the freed address (captured by KASAN as a read of size 8 at offset off_e8), a slab-use-after-free fault is triggered, crashing the kernel or potentially allowing localized memory manipulation depending on heap reuse patterns."
}