CVE-2026-64057: afs: Fix the locking used by afs_get_link()
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix the locking used by afs_get_link()
The afs filesystem in the kernel doesn't do locking correctly for symbolic
links. There are a number of problems:
(1) It doesn't do any locking around afs_read_single() to prevent races
between multiple ->get_link() calls, thereby allowing the possibility
of leaks.
(2) It doesn't use RCU barriering when accessing the buffer pointers
during RCU pathwalk.
(3) It can race with another thread updating the contents of the symlink
if a third party updated it on the server.
Fix this by the following means:
(0) Move symlink handling into its own file as this makes it more
complicated.
(1) Take the validate_lock around afs_read_single() to prevent races
between multiple ->get_link() calls.
(2) Keep a separate copy of the symlink contents with an rcu_head. This
is always going to be a lot smaller than a page, so it can be
kmalloc'd and save quite a bit of memory. It also needs a refcount
for non-RCU pathwalk.
(3) Split the symlink read and write-to-cache routines in afs from those
for directories.
(4) Discard the I/O buffer as soon as the write-to-cache completes as this
is a full page (plus a folio_queue).
(5) If there's no cache, discard the I/O buffer immediately after reading
and copying if there is no cache.
Security readout for executives and security teams
Plain-English summary
CVE-2026-64057 is a Linux kernel AFS filesystem bug involving unsafe symlink handling. A local authenticated user could potentially trigger race conditions that affect kernel memory safety. The CVSS score is high because successful exploitation could impact confidentiality, integrity, and availability, but the provided sources do not show active exploitation.
Executive priority
Treat as high priority for multi-user Linux systems, shared compute, and AFS users. Patch through normal emergency kernel update channels where exposure is confirmed.
Technical view
The AFS filesystem did not correctly lock or RCU-protect symlink content access in afs_get_link(). Races could occur between concurrent get_link calls, RCU pathwalk, and server-side symlink updates. The fix adds validate_lock use, separates symlink handling, keeps RCU-managed symlink copies, and frees I/O buffers earlier.
Likely exposure
Exposure is most likely on Linux systems running affected kernels where the AFS filesystem is enabled, loaded, or used. Practical risk depends on local user access and whether AFS symlinks are reachable.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. The source bundle says KEV is false and provides no evidence of active exploitation or public exploit availability.
Researcher notes
Version mapping in the supplied data is incomplete and may not directly map to distro packages. Validate against upstream stable commits and vendor advisories before declaring systems fixed or vulnerable.
Mitigation direction
Apply Linux kernel updates containing the referenced stable fixes.
Prioritize hosts with local untrusted users and AFS usage.
Check distribution advisories for backported fixed kernel packages.
Reduce untrusted local access to AFS-enabled systems until patched.
Validation and detection
Inventory kernel versions across Linux fleets.
Check whether AFS is enabled, loaded, or mounted.
Confirm installed kernels include the referenced stable commits or vendor backports.
Review vulnerability scanner findings against distro-specific advisories.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-64057 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
3Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.