CVE-2026-80885

What it actually does

Use-after-free in AFS OOB rxrpc message handler that can reference structures after net namespace teardown or cancellation failure.

Why it matters to the business

Linux systems using AFS face risk of kernel crashes or potential code execution, raising downtime and compromise exposure 25 days after disclosure with no known public exploits.

How an attack unfolds

An attacker triggers AFS OOB processing (e.g., security challenge responses) while manipulating network namespace lifetime so the handler runs after relevant objects are freed; the flaw allows the stale handler to dereference invalid memory.

How to fix it

Upgrade to a Linux kernel containing the fix that cancels the OOB handler, moves processing to afs_wq, and checks netns liveness before execution.

How to confirm the fix worked

Confirm the kernel source contains the described cancel, afs_wq move, and netns-live guard; test by exercising OOB paths under namespace teardown and verify absence of use-after-free warnings.

Typical attack path

1. Gain network access to an AFS client or server using rxrpc
2. Send crafted OOB messages that invoke the security-challenge path
3. Trigger netns teardown or handler cancellation race
4. Execute code or cause denial-of-service via the freed memory reference

How to detect it

Inspect kernel logs for AFS and rxrpc related oops/panics mentioning OOB handlers or netns; correlate with process crashes on systems running afs.ko.

What your security team should do

• Prioritize kernel updates on any systems exposing AFS/rxrpc
• Disable AFS where not required until patched
• Monitor vendor advisories for the exact fixed kernel versions
• Review crash dumps for AFS/rxrpc oops patterns