CVE-2025-21672

What it actually does

Early return in afs_proc_addr_prefs_write when argc < 0 leaves the inode lock held, violating the requirement to release locks before returning to userspace.

Why it matters to the business

Linux systems using the AFS client may experience kernel warnings and potential lock-related instability during address preference updates; the low EPSS and lack of KEV listing indicate limited real-world risk, though kernel updates remain advisable for stability.

How an attack unfolds

An attacker triggers the AFS proc interface write handler with crafted input causing argc to be negative, hitting the direct return path before the lock release in the done label; no named threat actors are associated with this specific issue.

How to fix it

Upgrade the Linux kernel to the commit 22be1d90a6211c88dd093b25d1f3aa974d0d9f9d or later stable releases that contain the fix for proper error handling and lock release via the done label.

How to confirm the fix worked

Confirm the kernel source contains the corrected afs_proc_addr_prefs_write logic that stores the error and jumps to done; verify absence of the lock-held warning when exercising the address prefs proc interface.

Typical attack path

1. Obtain local access to a system running the vulnerable Linux kernel with AFS enabled
2. Write to /proc/fs/afs/addr_prefs with input that sets argc < 0
3. Trigger the early return in afs_proc_addr_prefs_write
4. Observe the 'lock held when returning to user space' warning

How to detect it

Search kernel logs and dmesg output for the exact warning string 'lock held when returning to user space' together with references to afs_proc_addr_prefs_write or inode_lock.

• WARNING: lock held when returning to user space!
• afs_proc_addr_prefs_write
• inode_lock include/linux/fs.h

What your security team should do

• Apply the kernel patch or upgrade to a fixed version containing commit 22be1d90a6211c88dd093b25d1f3aa974d0d9f9d
• Monitor kernel logs for 'lock held when returning to user space' warnings on AFS-enabled systems
• Prioritize updates on any production systems running AFS clients even though exploit maturity is none