CVE-2026-80877: Linux Kernel VL List Information Disclosure

CVE-2026-80877 Overview

CVE-2026-80877 is a memory leak vulnerability in the Andrew File System (AFS) client of the Linux kernel. The flaw resides in the afs_update_cell() function, which mishandles reference tracking for the new volume location list (vllist) when the list is empty. When nr_servers == 0, the newly allocated vllist is not displaced by the old list unless the old list is also empty, leaving the allocation unreferenced. Repeated cell updates can slowly consume kernel memory on systems that mount AFS volumes.

Critical Impact
Repeated triggering of the code path can exhaust kernel memory, degrading system stability on hosts using the AFS filesystem.

Affected Products

Linux kernel (AFS filesystem subsystem, fs/afs/)
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Systems mounting AFS cells with dynamic volume location updates

Discovery Timeline

2026-09-04 - CVE-2026-80877 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80877

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the AFS client's cell update logic. The afs_update_cell() function in fs/afs/vl_rotate.c constructs a new volume location server list (vllist) when refreshing cell information. Under normal conditions, the newly built vllist replaces the previously cached one and the old list is released via RCU. When the newly built list contains zero servers (nr_servers == 0), the replacement logic short-circuits and only displaces the old list if it too is empty. In the mismatched case, the freshly allocated vllist becomes orphaned in kernel memory.

Each cell refresh cycle that returns an empty server set adds another leaked allocation. On long-running hosts or servers where DNS resolution for AFS Volume Location servers intermittently returns no records, the leak accumulates.

Root Cause

The root cause is incorrect reference handling in a conditional branch. The code assumes that a non-empty new list is always the trigger for displacing the old list, and fails to release the new allocation when it is discarded rather than installed. This is a logic error in resource ownership rather than a race condition.

Attack Vector

The vector is local and requires conditions that repeatedly invoke afs_update_cell() with an empty resolved server set. This typically occurs through recurring cell refresh timers or administrator-driven cell rescans while VL server DNS entries are unreachable. The issue does not offer code execution or privilege escalation, but progressive resource exhaustion can lead to denial-of-service conditions on hosts that rely on the AFS subsystem.

See the upstream fix commits in the Linux stable tree for the exact patch content.

Detection Methods for CVE-2026-80877

Indicators of Compromise

Gradual, unexplained growth in kernel slab allocations associated with AFS vllist structures reported by /proc/slabinfo.
Repeated afs_update_cell invocations coinciding with empty DNS results for AFS Volume Location servers.
Long-running hosts mounting AFS cells that show declining available memory without corresponding user-space consumption.

Detection Strategies

Track kernel memory consumption over time on hosts with the kafs module loaded and correlate spikes with AFS cell refresh events.
Use kmemleak on test kernels to identify unreferenced vllist allocations attributable to afs_update_cell().
Inventory endpoints and servers with the AFS filesystem enabled to establish exposure scope before patch rollout.

Monitoring Recommendations

Alert on sustained increases in Slab and SUnreclaim values from /proc/meminfo on AFS-enabled hosts.
Monitor DNS resolution health for AFS VL server records, as empty responses are the primary trigger for the leaked code path.
Log kernel version and module inventory in centralized telemetry to identify unpatched hosts running affected stable branches.

How to Mitigate CVE-2026-80877

Immediate Actions Required

Identify all hosts with the AFS kernel module (kafs) loaded or that mount AFS cells.
Prioritize patching long-running servers, since the leak accumulates over time.
Schedule kernel updates to a stable release containing one of the fix commits referenced below.

Patch Information

The issue is resolved by upstream commits merged into multiple Linux stable branches. Apply a kernel build that includes the fix commit corresponding to your branch: 13403945, 2b169eed, 8afb1a78, 91d8f8e5, bef5514f, bf55969d, fbfe75c8, or fc10c0ec. Reboot hosts to activate the patched kernel.

Workarounds

Unload the kafs module on hosts that do not require AFS: modprobe -r kafs.
Blacklist the module where AFS is not a functional requirement to prevent inadvertent loading.
Periodically reboot AFS-serving hosts to reclaim leaked kernel memory until the patch is deployed.

bash

# Verify AFS module state and blacklist if unused
lsmod | grep -i kafs
echo 'blacklist kafs' | sudo tee /etc/modprobe.d/blacklist-kafs.conf
sudo depmod -a