CVE-2026-97585

A moderate impact flaw was found in the Linux kernel's AFS (Andrew File System) implementation. When removing an entry from an AFS directory, the afs_edit_dir_remove() function manually unmaps a mapped directory block without clearing the iterator state, so if afs_dir_find_block() is called a second time (which happens when the block being modified is not first in the hash chain), the same block can be unmapped twice. A local user with permission to modify an AFS directory can trigger this flaw through directory modification operations, potentially leading to a kernel crash or memory corruption and resulting in a denial of service. Red Hat rates this flaw MODERATE (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no confidentiality or integrity impact has been established.

The vulnerable code is present only in newer kernel streams: Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, and rhel-10.4), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and the OpenShift Container Platform 5.0 RHEL CoreOS 9 kernel are affected. Earlier Red Hat Enterprise Linux versions (including RHEL 6, HEL 7, 8, 9, and RHEL 10.0.z), the real-time (kernel-rt) variants, and the OpenShift 4.x streams are not affected because the code that introduced this flaw is not present in those products. For the affected products the fix is currently deferred and will be delivered in a future update; the residual risk is a local denial of service on systems where AFS filesystems are mounted and unprivileged local users are able to modify AFS directories.