CVE-2024-26848

What it actually does

The flaw causes an endless loop in afs_dir_iterate() when a directory block contains only .__afsXXXX files from incomplete silly-renames; the skip logic fails to advance the dir_context file position, so the same block is reprocessed repeatedly leading to a CPU soft lockup.

Why it matters to the business

Affected Linux systems using the AFS filesystem can become unresponsive, causing service outages and requiring reboots; the long-publication window and kernel-wide impact increase exposure across many distributions.

How an attack unfolds

An attacker or local process arranges a directory whose blocks contain only the temporary .__afsXXXX entries, then invokes readdir or getdents; the kernel enters afs_dir_iterate_block which loops without progress, triggering the watchdog soft-lockup and denial of service.

How to fix it

Apply the upstream fix that manually advances the file position when skipping .__afsXXXX entries; update to a patched Linux kernel release that resolves the AFS directory-parsing loop.

How to confirm the fix worked

Confirm the running kernel contains the commit that advances the dir_context position in afs_dir_iterate_block; reproduce a directory with only .__afsXXXX files and verify that readdir completes without soft lockup.

Typical attack path

1. Create or locate a directory containing only .__afsXXXX files
2. Invoke directory enumeration via getdents64 or equivalent
3. Trigger repeated execution of afs_dir_iterate_block without file-position advance
4. Induce soft lockup and system unresponsiveness

How to detect it

Search kernel logs and watchdog reports for repeated afs_dir_iterate_block entries and soft-lockup stack traces; inspect dmesg or journalctl for the exact RIP and function sequence shown in the advisory.

What your security team should do

• Prioritize kernel updates on all systems mounting AFS filesystems
• Monitor kernel logs for soft-lockup messages referencing afs_dir_iterate
• Temporarily avoid AFS mounts on unpatched kernels until remediation is complete