CVE-2026-68168 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix afs_edit_dir_remove() to get, not find, block 0
Fix afs_edit_dir_remove() to use afs_dir_get_block() to get block 0 rather than afs_dir_find_block() as the latter caches the found block in the afs_dir_iter and may[*] switch out the page it's on if another
afs_dir_find_block() is done. This parallels what afs_edit_dir_add() does.
[*] There's more than one block per page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability addressed in this linux kernel fix relates to improper handling of directory block management within the Andrew File System implementation. The issue specifically affects the afs_edit_dir_remove() function which is responsible for removing entries from AFS directories. This flaw stems from a fundamental misunderstanding of how directory blocks should be accessed and managed during modification operations.
The technical root cause involves the incorrect use of afs_dir_find_block() instead of afs_dir_get_block() when accessing block 0 during directory removal operations. The afs_dir_find_block() function is designed for locating existing blocks within a directory structure, but it maintains internal caching mechanisms through the afs_dir_iter structure that can lead to unexpected behavior. When multiple calls to afs_dir_find_block() occur, the cached information may cause the system to switch pages unexpectedly, particularly when more than one block exists per page as noted in the advisory.
This improper block access pattern creates a critical race condition and memory management issue within the AFS subsystem. The caching mechanism in afs_dir_find_block() can result in stale references or incorrect page mappings that compromise directory integrity. When afs_edit_dir_remove() uses this function to access block 0, it may inadvertently modify data structures on pages that have been swapped out or reallocated by subsequent cache operations.
The operational impact of this vulnerability extends beyond simple data corruption risks. Attackers could potentially exploit this flaw to manipulate directory entries in ways that compromise file system integrity and availability. This type of issue falls under CWE-129 Input Validation and the improper handling of memory references aligns with ATT&CK technique T1059 Command and Scripting Interpreter. The vulnerability particularly affects systems heavily reliant on AFS for file storage operations, where directory consistency is paramount for maintaining data integrity.
The fix implemented addresses this by changing afs_edit_dir_remove() to use afs_dir_get_block() instead of afs_dir_find_block(). This change ensures that block 0 is properly accessed without the risk of cache-related page switching behavior. The solution mirrors the approach already used in afs_edit_dir_add(), establishing consistency across directory modification operations. This remediation prevents the potential for memory corruption and maintains proper page mapping during directory operations, aligning with industry best practices for filesystem integrity management.
The resolution demonstrates the importance of understanding the subtle differences between block access functions within kernel subsystems. Proper function selection based on intended operation is crucial for maintaining system stability and preventing cascading failures in file system implementations. This vulnerability highlights the complexity of managing shared data structures in kernel space and the critical need for careful consideration of caching behavior in concurrent environments. The fix ensures that directory operations maintain proper state management and prevent potential exploitation scenarios that could lead to unauthorized access or denial of service conditions within AFS implementations.