CVE-2026-46100 Overview
CVE-2026-46100 is a Linux kernel vulnerability in the Andrew File System (AFS) memory-mapped file handling code. The flaw stems from an incomplete conversion of generic_file_*mmap() users to the new .mmap_prepare() interface introduced in commit 9d5403b1036c. The kernel maintainers issued a partial revert to address the issue.
The .mmap invocation establishes a reference count, but .mmap_prepare is called at a point where a virtual memory area (VMA) merge or allocation failure can occur after the call. This sequence leaks the refcount increment on failure paths.
Critical Impact
Improper reference count handling in the AFS .mmap_prepare() path can leak kernel object references, potentially leading to resource exhaustion or use-after-free conditions in memory-mapped file operations.
Affected Products
- Linux kernel versions containing commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()")
- AFS (Andrew File System) subsystem in affected kernel builds
- Downstream Linux distributions packaging the affected kernel revisions
Discovery Timeline
- 2026-05-27 - CVE-2026-46100 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46100
Vulnerability Analysis
The vulnerability resides in the Linux kernel AFS filesystem mmap implementation. Commit 9d5403b1036c migrated most generic_file_*mmap() callers to the new .mmap_prepare() callback interface. This interface is invoked earlier in the mmap pipeline than the legacy .mmap handler.
The legacy .mmap callback runs after the VMA is fully established, so reference counts taken inside the callback are tied to a live mapping. By contrast, .mmap_prepare() executes before the VMA is finalized. Subsequent steps such as VMA merging or memory allocation can still fail, and on failure the kernel does not invoke a matching release path for refcounts acquired in .mmap_prepare().
For AFS, this mismatch leaks the refcount increment whenever the mmap operation aborts after .mmap_prepare() returns. The maintainers therefore partially reverted the AFS portion of the original commit until the underlying .mmap_prepare() infrastructure supports refcount-aware semantics.
Root Cause
The root cause is an API contract mismatch between .mmap and .mmap_prepare(). AFS code performed reference acquisition that was safe under .mmap semantics but unsafe when relocated to .mmap_prepare(). No compensating release exists for failure paths between .mmap_prepare() and successful VMA installation, producing a kernel resource leak.
Attack Vector
This is a kernel-local issue triggered through legitimate filesystem operations. A local user with access to an AFS mount can repeatedly invoke mmap() system calls against AFS-backed files under conditions that induce VMA merge or allocation failures. Each failed mapping increments the underlying object refcount without a corresponding decrement.
See the upstream fixes for the precise code paths: Kernel Git Commit 48c7a0e, Kernel Git Commit f51f85c, and Kernel Git Commit fbfc6578.
Detection Methods for CVE-2026-46100
Indicators of Compromise
- Growing kernel slab usage tied to AFS inode or file objects without corresponding open file descriptors
- Repeated mmap() failures against AFS-mounted paths recorded in audit logs
- Kernel reference count warnings or leaked-object messages referencing the AFS subsystem in dmesg
Detection Strategies
- Audit running kernel versions across the fleet and identify hosts running kernel builds that include commit 9d5403b1036c but lack the revert commits listed above
- Monitor /proc/slabinfo for sustained growth in AFS-related caches on hosts that mount AFS volumes
- Correlate process-level mmap syscall telemetry with AFS mount points to identify abnormal mapping patterns
Monitoring Recommendations
- Collect kernel logs centrally and alert on AFS-related WARN or refcount messages
- Track per-host kernel memory utilization trends for hosts exposing AFS to multiple users
- Inventory kernel package versions continuously so vulnerable builds are flagged immediately after patch publication
How to Mitigate CVE-2026-46100
Immediate Actions Required
- Apply the upstream kernel updates that include the AFS .mmap_prepare() revert from commits 48c7a0e, f51f85c, and fbfc6578
- Restrict AFS mount exposure to trusted users until patched kernels are deployed
- Restart hosts after kernel package upgrades to ensure the patched kernel image is loaded
Patch Information
The Linux kernel maintainers resolved the issue by partially reverting the AFS portion of commit 9d5403b1036c. The fix is distributed across three stable tree commits: Kernel Git Commit 48c7a0e, Kernel Git Commit f51f85c, and Kernel Git Commit fbfc6578. Apply the vendor-provided kernel package that incorporates these commits for your distribution.
Workarounds
- Unmount AFS volumes on hosts where the patch cannot be applied immediately
- Limit local shell access on systems exposing AFS to reduce the population that can trigger the leak
- Schedule periodic reboots to clear leaked kernel references until a patched kernel is installed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
