EUVD-2026-59572
GHSA-pvfc-84wr-qwjc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AFS must be explicitly configured on the target (non-default), raising AC to H; no authentication needed to send crafted callback packets; impact is pure availability.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
afs: handle CB.InitCallBackState3 requests without a server record
The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist for every callback request, and most callback handlers already tolerate that case.
Make CB.InitCallBackState3 follow the same pattern by checking whether a server record was attached before using it. If the peer is not mapped to a server record, trace the request and ignore it, matching the existing behaviour for other unmatched callback requests.
This keeps the callback handler consistent with the rest of the cache manager service and avoids depending on peer state that may not be available for a given request.
AnalysisAI
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system has the Linux kernel's AFS client module (kafs) loaded and AFS configured - neither condition is present in default Linux installations on any major distribution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a 7.5 score that overstates practical risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a Linux host that has AFS configured and the kafs module loaded sends a crafted CB.InitCallBackState3 packet to the AFS cache manager service on that host. The packet arrives on an rxrpc peer that has no server record mapped to it, triggering the unguarded code path. … |
| Remediation | The primary remediation is to update the Linux kernel to a patched version: 6.18.40, 7.1.5, or 7.2-rc2, as confirmed by EUVD data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether your organization operates systems with the Linux kernel's AFS module enabled and request vendor advisory details specifying patched kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today