CVE-2026-46100: fs: afs: revert mmap_prepare() change

Synopsis

A reference-count leak vulnerability exists in the Linux kernel's AFS (Andrew File System) memory-mapping path. An attacker with a local, low-privilege account can trigger the bug by causing a merge or allocation failure after mmap_prepare() increments a reference count without a corresponding release, corrupting kernel memory state. Successful exploitation gives the attacker full read, write, and crash-level control over the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or root access to trigger the mmap_prepare() reference-count leak.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability entirely through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including credentials, session tokens, and data belonging to other processes on the host.
• The attacker writes to arbitrary kernel memory, enabling privilege escalation to root or modification of security-relevant kernel structures.
• The attacker can crash the affected system by corrupting kernel state through the leaked reference count, causing a denial of service for all workloads on the node.
• Container workloads sharing the host kernel are exposed to the same impact, because the vulnerability is in the host kernel's AFS subsystem.