Linux Kernel EUVD-2026-28769

Exploitation requires: (1) local authenticated access to the target system (CVSS PR:L - low-privileged account sufficient); (2) the AFS kernel client subsystem (kAFS / af_rxrpc modules) must be loaded and operational - this is a non-default configuration on most general-purpose Linux distributions; (3) the attacker must be able to trigger a peer lookup failure, which can occur under memory pressure or when an AFS server is unreachable. Exploitation is limited to systems where the AFS filesystem client is actively used (typically academic or research environments using OpenAFS infrastructure). Systems without the kafs/af_rxrpc modules loaded are not affected, regardless of kernel version. Remote exploitation is not possible per CVSS AV:L.

CVSS 3.1 scores this at 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, low-complexity attack requiring only low-level privileges, with no confidentiality or integrity impact but high availability impact (kernel crash/panic). The EPSS score of 0.02% (4th percentile) aligns with the low exploitability expectation for a local DoS in a niche kernel subsystem - AFS client usage is uncommon in most deployments, which limits the realistic attack surface significantly. This CVE is not listed in CISA KEV and no public exploit code has been identified at time of analysis. The combination of local-only access, low EPSS, no KEV listing, and the requirement that the AFS filesystem client be actively in use means real-world exploitation risk is low for the majority of Linux deployments. Administrators running AFS client workloads (research institutions, academic environments) should prioritize patching, as a local unprivileged user on such systems could reliably crash the host.

A local user with standard (unprivileged) account access on a Linux host running an AFS-enabled kernel mounts or interacts with an AFS filesystem path in a way that triggers a peer lookup failure (e.g., under low-memory conditions or against an unreachable AFS server). The rxrpc_kernel_lookup_peer() function returns an ERR_PTR value; the unchecked AFS caller dereferences it as a valid peer object, causing a kernel NULL/invalid pointer dereference and immediate system panic. No public proof-of-concept code has been identified, but the conditions are straightforward to reproduce on affected kernels with AFS client support compiled in.