Bug 2513461 (CVE-2026-68168)

Summary:	CVE-2026-68168 kernel: afs: Fix afs_edit_dir_remove() to get, not find, block 0
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Andrew File System (AFS) component. The system's directory removal function, afs_edit_dir_remove(), incorrectly manages memory blocks, specifically block 0. This improper handling could lead to an unstable system state or data integrity issues during directory operations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:38:39 UTC

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix afs_edit_dir_remove() to get, not find, block 0

Fix afs_edit_dir_remove() to use afs_dir_get_block() to get block 0 rather
than afs_dir_find_block() as the latter caches the found block in the
afs_dir_iter and may[*] switch out the page it's on if another
afs_dir_find_block() is done.  This parallels what afs_edit_dir_add() does.

[*] There's more than one block per page.

Comment 1 Mauro Matteo Cascella 2026-08-11 11:00:16 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081005-CVE-2026-68168-38e8@gregkh/T