CVE-2026-64057

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> afs: Fix the locking used by afs_get_link()<br /> <br /> The afs filesystem in the kernel doesn&amp;#39;t do locking correctly for symbolic<br /> links. There are a number of problems:<br /> <br /> (1) It doesn&amp;#39;t do any locking around afs_read_single() to prevent races<br /> between multiple -&gt;get_link() calls, thereby allowing the possibility<br /> of leaks.<br /> <br /> (2) It doesn&amp;#39;t use RCU barriering when accessing the buffer pointers<br /> during RCU pathwalk.<br /> <br /> (3) It can race with another thread updating the contents of the symlink<br /> if a third party updated it on the server.<br /> <br /> Fix this by the following means:<br /> <br /> (0) Move symlink handling into its own file as this makes it more<br /> complicated.<br /> <br /> (1) Take the validate_lock around afs_read_single() to prevent races<br /> between multiple -&gt;get_link() calls.<br /> <br /> (2) Keep a separate copy of the symlink contents with an rcu_head. This<br /> is always going to be a lot smaller than a page, so it can be<br /> kmalloc&amp;#39;d and save quite a bit of memory. It also needs a refcount<br /> for non-RCU pathwalk.<br /> <br /> (3) Split the symlink read and write-to-cache routines in afs from those<br /> for directories.<br /> <br /> (4) Discard the I/O buffer as soon as the write-to-cache completes as this<br /> is a full page (plus a folio_queue).<br /> <br /> (5) If there&amp;#39;s no cache, discard the I/O buffer immediately after reading<br /> and copying if there is no cache.