CVE-2026-80878: Linux Kernel AFS Information Disclosure

CVE-2026-80878 Overview

CVE-2026-80878 is a memory management flaw in the Linux kernel's Andrew File System (AFS) client. The function afs_lookup_volume_rcu() leaks a dying volume reference when afs_try_get_volume() fails. The upstream fix addresses improper handling of the failure path during a read-copy-update (RCU) volume lookup.

The issue is tracked as a kernel memory leak in the afs subsystem and has been patched across affected stable branches through the kernel.org stable tree.

Critical Impact
Repeated failures in the AFS volume lookup path can exhaust kernel memory over time, degrading system stability on hosts that mount AFS volumes.

Affected Products

Linux kernel builds containing the vulnerable afs_lookup_volume_rcu() implementation
Systems using the in-kernel AFS client to mount Andrew File System volumes
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80878 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80878

Vulnerability Analysis

The defect resides in the Linux kernel AFS client, specifically in afs_lookup_volume_rcu(). This function performs a volume lookup under RCU protection and attempts to acquire a reference on the located volume through afs_try_get_volume().

When afs_try_get_volume() fails, typically because the volume is in a dying state and its reference count cannot be safely incremented, the lookup function returns without releasing resources associated with the ungot volume. The result is a kernel-space reference leak that accumulates each time the failure path is triggered.

The upstream resolution modifies the failure branch so the volume is properly released before returning. Fix commits are available in the kernel stable tree at 78e8ee25a5e8, 9cabf1c86948, and d672c276f685.

Root Cause

The root cause is a missing cleanup step on an error path [Memory Leak]. The function assumed successful acquisition would occur, and did not account for the dying-volume state where afs_try_get_volume() legitimately returns failure. The absent release call left the volume object referenced beyond its intended lifetime.

Attack Vector

The vulnerability requires interaction with the AFS client subsystem, generally through file system operations against AFS-mounted volumes. Triggering the leak requires conditions where volume lookups race with volumes transitioning to a dying state. No remote unauthenticated exploitation path is documented, and no public exploit or proof-of-concept has been published.

The vulnerability is described in prose rather than code. Refer to the Kernel Git Commit Fix for the exact source-level change.

Detection Methods for CVE-2026-80878

Indicators of Compromise

Growth in kernel slab allocations associated with AFS volume structures over extended uptime
Repeated warnings or lookup failures logged by the afs subsystem in dmesg
Unexplained kernel memory pressure on hosts actively mounting AFS volumes

Detection Strategies

Compare running kernel versions against the fixed commits 78e8ee25a5e8, 9cabf1c86948, and d672c276f685 using uname -r and distribution changelogs
Track slabtop and /proc/slabinfo for sustained growth in AFS-related caches on affected hosts
Enable kernel memory leak detection with kmemleak on non-production hosts to observe volume references that outlive expected lifetimes

Monitoring Recommendations

Collect kernel logs centrally and alert on repeated afs volume lookup failures
Baseline kernel slab consumption on AFS clients and alert on sustained upward trends
Track kernel patch levels across the fleet through configuration management inventories

How to Mitigate CVE-2026-80878

Immediate Actions Required

Apply the vendor kernel update that includes the referenced stable-tree fix commits
Reboot affected hosts after patching to ensure the corrected afs module is loaded
Inventory hosts that mount AFS volumes and prioritize them for the update cycle

Patch Information

The fix is available in the kernel.org stable tree. Reference the commits 78e8ee25a5e8, 9cabf1c86948, and d672c276f685. Consume the fix through your distribution's kernel package channel rather than manual backports where possible.

Workarounds

Unmount AFS volumes and unload the kafs kernel module on hosts that do not require AFS access until patching completes
Schedule periodic reboots on long-running AFS clients to reclaim leaked kernel memory as an interim measure
Restrict AFS mounts to hosts with active monitoring for kernel memory growth

bash

# Verify installed kernel and AFS module status
uname -r
lsmod | grep kafs

# Temporary mitigation: unmount AFS and unload the module
sudo umount -a -t afs
sudo modprobe -r kafs