Linux Kernel CVE-2026-46100

The Andrew File System (AFS) is a distributed network filesystem implementation in the Linux kernel (fs/afs). The kernel recently introduced a .mmap_prepare() callback intended to replace the legacy .mmap callback for many generic_file_*mmap() users. The crucial semantic difference is that .mmap is invoked after the VMA is fully set up and any refcounts taken inside survive subsequent steps, whereas .mmap_prepare() runs earlier - before a possible VMA merge or post-allocation failure path - meaning any refcount increment taken inside .mmap_prepare() can be leaked if the surrounding mmap machinery later aborts or coalesces VMAs. AFS's mmap path establishes a refcount on the underlying cache/file object, so converting it to .mmap_prepare() (commit 9d5403b1036c) introduced a reference leak. CWE is not assigned but this maps to CWE-911 (Improper Update of Reference Count) / CWE-401 (Missing Release of Memory after Effective Lifetime).