CVE-2025-21646

What it actually does

The kafs module accepts cell names up to 256 bytes but procfs enforces a 255-byte filename limit, causing a kernel warning when a maximum-length cell name is registered under /proc/net/afs/. DNS constraints further reduce the practical maximum to 253 bytes.

Why it matters to the business

Systems using the AFS client may encounter unexpected kernel warnings or mount failures when cell names approach the protocol maximum, increasing operational noise and potential mountpoint creation issues in large or automated deployments.

How an attack unfolds

An attacker would supply or trigger registration of a 256-byte AFS cell name via mount or /proc interaction; the kernel then attempts an oversized procfs directory creation that triggers the length check failure. No known in-the-wild exploitation exists for this input-validation issue.

How to fix it

Update the Linux kernel to commit 9340385468d056bb700b8f28df236b81fc86a079 or later releases that enforce a 253-byte cell-name limit. For the listed Red Hat OpenShift nodejs packages apply the referenced fixed versions (accepts 1.3.3-1.el7, express 4.13.3-4.el7, etc.).

How to confirm the fix worked

Confirm the running kernel contains commit 9340385468d056bb700b8f28df236b81fc86a079; attempt to register a 253-byte and a 254-byte cell name and verify only the former succeeds without warning.

Typical attack path

1. Identify or control an AFS cell name of 256 bytes
2. Trigger kafs cell registration or mount operation
3. Observe resulting WARNING in fs/proc/generic.c

How to detect it

Search kernel logs for the exact WARNING line from fs/proc/generic.c:405 mentioning afs cell names; no authenticated exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on any system mounting AFS filesystems
• Review cell-name provisioning processes to stay under 253 bytes
• Monitor for fs/proc/generic.c warnings related to afs