CVE-2026-80885 Overview
CVE-2026-80885 is a Linux kernel vulnerability in the Andrew File System (AFS) subsystem. The flaw involves an uncancelled rxrpc out-of-band (OOB) message handler that continues processing after it should have terminated. AFS uses OOB messages to respond to security challenges from remote fileservers over the rxrpc transport protocol. The upstream fix cancels OOB message processing, moves it onto the afs_wq workqueue so it is properly waited on, and causes the OOB handler to return early when the network namespace is no longer live.
Critical Impact
The uncancelled handler can execute against a torn-down network namespace, creating conditions for use-after-free or improper state handling within the kernel AFS client.
Affected Products
- Linux kernel (mainline) with the AFS filesystem client enabled
- Linux stable kernel branches receiving the referenced rxrpc OOB handling changes
- Distributions shipping AFS support via kafs prior to the backported fix
Discovery Timeline
- 2026-09-04 - CVE-2026-80885 published to the National Vulnerability Database (NVD)
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80885
Vulnerability Analysis
The Linux AFS client relies on the rxrpc transport to communicate with AFS fileservers. When a server issues a security challenge, AFS handles the resulting OOB message to authenticate the exchange. Prior to the fix, the AFS module did not cancel its OOB message processing during teardown. The handler could continue running against structures that were being dismantled, including in scenarios where the network namespace hosting the connection was no longer live.
The patch series addresses three related issues in the AFS OOB pipeline. First, it explicitly cancels pending OOB message processing when the subsystem tears down. Second, it relocates OOB handling to the afs_wq workqueue so shutdown paths correctly wait for outstanding work to complete. Third, the OOB handler now performs an early return when it detects that the associated network namespace has been dismantled.
Root Cause
The root cause is missing cancellation and lifecycle management for asynchronous OOB message work items in the AFS rxrpc handler. Work continued executing outside the intended lifetime of its owning context, creating a race between message processing and subsystem or namespace teardown.
Attack Vector
CVSS metrics were not published for this identifier at the time of NVD entry. Triggering the condition requires the AFS client to have active rxrpc connections while the associated network namespace or subsystem is being torn down. Exploitability depends on local kernel state and timing rather than a directly reachable network primitive. Full technical context is available in the referenced kernel commits: Kernel commit 2314142, Kernel commit a4057e5, and Kernel commit d14e96d.
No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit messages.
Detection Methods for CVE-2026-80885
Indicators of Compromise
- Kernel oops or warning messages referencing afs, rxrpc, or OOB message handling in dmesg output
- Unexpected kernel panics on hosts that mount AFS volumes and use network namespaces
- KASAN reports involving AFS workqueue items or rxrpc sockets on instrumented kernels
Detection Strategies
- Inventory Linux hosts with the kafs module loaded and identify which run inside or manage transient network namespaces
- Correlate kernel log anomalies with AFS mount, unmount, or container lifecycle events
- Compare running kernel versions against distribution advisories that reference the three upstream commits listed above
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized analytics platform for correlation across hosts
- Alert on repeated AFS or rxrpc warnings originating from container hosts or namespace-heavy workloads
- Track kernel package versions across the fleet to confirm patched builds are deployed
How to Mitigate CVE-2026-80885
Immediate Actions Required
- Apply the stable kernel update that includes commits 2314142, a4057e5, and d14e96d from git.kernel.org
- Reboot affected hosts after installing the patched kernel to activate the fix
- Prioritize systems that mount AFS volumes or operate rxrpc connections inside network namespaces
Patch Information
The fix is delivered through three upstream Linux kernel commits: Kernel commit 231414253b648b3518b56f09710b831945d6a2fc, Kernel commit a4057e58b07005d0fe0491bdbf1868c1491909ee, and Kernel commit d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4. Consult your Linux distribution vendor for the corresponding backported kernel package.
Workarounds
- Unload the kafs module on systems that do not require AFS connectivity using modprobe -r kafs
- Blacklist the AFS module in /etc/modprobe.d/ where the filesystem is not needed
- Avoid tearing down network namespaces that host active AFS rxrpc connections until the patched kernel is installed
# Verify the running kernel and AFS module status
uname -r
lsmod | grep -E 'kafs|rxrpc'
# Prevent AFS module from loading on hosts that do not use it
echo 'blacklist kafs' | sudo tee /etc/modprobe.d/disable-kafs.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.