CVE-2026-80878

What it actually does

The flaw is a memory leak in afs_lookup_volume_rcu() that fails to release a dying volume reference when afs_try_get_volume() returns failure, causing gradual kernel memory consumption in the AFS filesystem subsystem.

Why it matters to the business

Systems using the AFS network filesystem may experience increasing memory pressure over time, leading to degraded performance, reduced capacity for other workloads, or eventual kernel instability requiring reboots.

How an attack unfolds

An attacker with the ability to trigger repeated AFS volume lookup operations that cause afs_try_get_volume() to fail can force the kernel to leak volume structures, exhausting memory resources without direct code execution.

How to fix it

Apply the upstream kernel patch that corrects the reference counting in afs_lookup_volume_rcu() and afs_try_get_volume(); update to a kernel version containing the fix and rebuild any custom modules as needed.

How to confirm the fix worked

Confirm the presence of the correcting commit in the kernel source tree or verify that afs_lookup_volume_rcu() no longer leaks on the failure path via code review or targeted stress testing with volume lookup failures.

Typical attack path

1. Identify systems exposing or mounting AFS volumes
2. Craft or induce repeated volume lookup calls that hit the failure path in afs_lookup_volume_rcu()
3. Repeat the operation to accumulate leaked kernel memory until resource limits are hit

How to detect it

Review kernel memory allocator statistics and slab usage for unexpected growth in AFS-related structures; correlate with logs showing repeated afs volume lookup failures.

What your security team should do

• Prioritize kernel updates for any systems actively using AFS
• Monitor memory usage trends on AFS clients and servers for unexplained growth
• Disable AFS mounts where the filesystem is not required to reduce attack surface