CVE-2026-64057 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix the locking used by afs_get_link()
The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems:
(1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks.
(2) It doesn't use RCU barriering when accessing the buffer pointers during RCU pathwalk.
(3) It can race with another thread updating the contents of the symlink if a third party updated it on the server.
Fix this by the following means:
(0) Move symlink handling into its own file as this makes it more complicated.
(1) Take the validate_lock around afs_read_single() to prevent races between multiple ->get_link() calls.
(2) Keep a separate copy of the symlink contents with an rcu_head. This is always going to be a lot smaller than a page, so it can be kmalloc'd and save quite a bit of memory. It also needs a refcount for non-RCU pathwalk.
(3) Split the symlink read and write-to-cache routines in afs from those for directories.
(4) Discard the I/O buffer as soon as the write-to-cache completes as this is a full page (plus a folio_queue).
(5) If there's no cache, discard the I/O buffer immediately after reading and copying if there is no cache.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The Linux kernel's Andrew File System (AFS) implementation contains a critical locking vulnerability in the afs_get_link() function that compromises the integrity of symbolic link handling operations. This vulnerability stems from inadequate synchronization mechanisms during concurrent access scenarios, creating multiple race conditions that can lead to memory leaks and data corruption. The flaw specifically affects how the filesystem manages concurrent read operations on symbolic links, where multiple threads attempting to resolve symlinks simultaneously can trigger unpredictable behavior due to missing protective barriers.
The technical implementation issues manifest in three primary areas that collectively undermine the filesystem's reliability. First, the absence of proper locking around afs_read_single() function calls creates a race condition between multiple get_link() operations, allowing concurrent access patterns that may result in memory leaks and inconsistent symlink states. Second, the implementation fails to utilize RCU (Read-Copy-Update) barriering when accessing buffer pointers during RCU pathwalk operations, which violates fundamental RCU synchronization principles and can cause stale data references. Third, the code does not properly synchronize with external updates to symlink contents, creating potential conflicts when third-party processes modify symlink targets on the server while other threads are reading them.
This vulnerability directly maps to CWE-362, which describes a race condition in concurrent programming where multiple threads access shared resources without proper synchronization. The security implications extend beyond simple data corruption, as improper locking can potentially enable privilege escalation or information disclosure attacks through memory corruption. The flaw also aligns with ATT&CK technique T1059.007 which covers Unix shell commands and scripts, as compromised symlink handling could be exploited to manipulate file system paths in malicious ways.
The proposed mitigation strategy addresses these issues through comprehensive architectural changes that improve both safety and efficiency. Moving symlink handling into a dedicated file modularizes the complex logic and reduces interdependencies while maintaining code clarity. The implementation introduces validate_lock protection around afs_read_single() calls to prevent concurrent get_link() operations from interfering with each other during critical sections. Additionally, the solution implements a separate copy of symlink contents using rcu_head structures that are significantly smaller than full pages, enabling kmalloc allocation and reducing memory overhead while maintaining proper reference counting for non-RCU pathwalk scenarios.
The fix also separates symlink read and write operations from directory handling routines, creating cleaner code boundaries and reducing potential for cross-contamination between different filesystem object types. Memory management improvements include immediate discarding of I/O buffers after cache writes, eliminating the retention of full page structures plus folio_queue overhead that could otherwise persist unnecessarily. When no cache exists, the implementation immediately disposes of I/O buffers after reading and copying operations, preventing memory leaks while maintaining system performance characteristics.
These changes collectively address the root causes of the locking vulnerability by implementing proper synchronization primitives, establishing clear data access patterns, and optimizing resource management. The solution maintains backward compatibility while significantly improving the robustness of AFS symlink handling under concurrent access scenarios. The approach follows established kernel development practices for RCU implementation and memory management, ensuring that the fix aligns with Linux kernel security standards and best practices for maintaining filesystem integrity in multi-threaded environments.
The vulnerability resolution demonstrates the importance of proper locking mechanisms in kernel space filesystem implementations, where inadequate synchronization can create exploitable conditions. By implementing comprehensive protection measures including validate_lock acquisition, RCU-aware buffer management, and efficient memory cleanup procedures, the fix ensures that AFS symbolic link operations remain reliable even under high concurrency loads. This improvement contributes to overall system stability by preventing potential denial-of-service conditions and maintaining data consistency across simultaneous access patterns.