{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21646", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.728Z", "datePublished": "2025-01-19T10:18:02.776Z", "dateUpdated": "2026-08-05T11:53:20.429Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:20.429Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix the maximum cell name length\n\nThe kafs filesystem limits the maximum length of a cell to 256 bytes, but a\nproblem occurs if someone actually does that: kafs tries to create a\ndirectory under /proc/net/afs/ with the name of the cell, but that fails\nwith a warning:\n\n WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405\n\nbecause procfs limits the maximum filename length to 255.\n\nHowever, the DNS limits the maximum lookup length and, by extension, the\nmaximum cell name, to 255 less two (length count and trailing NUL).\n\nFix this by limiting the maximum acceptable cellname length to 253. This\nalso allows us to be sure we can create the \"/afs/./\" mountpoint too.\n\nFurther, split the YFS VL record cell name maximum to be the 256 allowed by\nthe protocol and ignore the record retrieved by YFSVL.GetCellName if it\nexceeds 253." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The over-length cell name originates in a YFSVL.GetCellName reply processed by afs_deliver_yfsvl_get_cell_name() from a remote AFS/YFS Volume Location server over rxrpc/UDP port 7003, and is passed to afs_lookup_cell() by yfs_check_canonical_cell_name(); a 256-byte name is in fact only reachable this way, since local path components are capped at NAME_MAX (255).\nAC:L - A malicious, compromised, or DNS/UDP-spoofed VL server simply returns a 256-byte cell name in its GetCellName reply, which the pre-fix code accepts unconditionally — deterministic, no race and no memory-layout dependency.\nPR:N - The VL server response is consumed using the anonymous rxnull key with no authentication of the peer, so the attacker needs no credentials or account on the target host; the local automount path that initiates the RPC is likewise available to any unprivileged user with /afs access.\nUI:N - kAFS contacts its cells' VL servers autonomously — at mount, on automount traversal, and again whenever a GC'd cell record is recreated with AFS_CELL_FL_CHECK_ALIAS set — so a compromised VL server for a cell the client already uses is queried during normal operation without any targeted victim action.\nS:U - The fault and its consequences stay entirely within the kernel of the AFS client; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is purely a length-limit mismatch between AFS_MAXCELLNAME and the procfs name limit; no out-of-bounds read, use-after-free, or uninitialized data is exposed, and all associated buffers (keyname[261], kmalloc(AFS_MAXCELLNAME+1)) exactly accommodate a 256-byte name.\nI:N - There is no out-of-bounds write, type confusion, or attacker-controlled write primitive; the proc directory creation is cleanly rejected and cell activation fails with -ENOMEM, leaving no corrupted state.\nA:H - The path reaches WARN(1, \"name len %u\\n\") in proc_register(), producing a kernel warning splat that is an immediate panic on the many hardened, cloud, Android, and CI kernels booted with panic_on_warn=1, and it is repeatable on every cell lookup rather than a WARN_ONCE." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/afs/afs.h", "fs/afs/afs_vl.h", "fs/afs/vl_alias.c", "fs/afs/vlclient.c" ], "versions": [ { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "9340385468d056bb700b8f28df236b81fc86a079", "status": "affected", "versionType": "git" }, { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "7cb3e77e9b4e6ffa325a5559393d3283c9af3d01", "status": "affected", "versionType": "git" }, { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "aabe47cf5ac5e1db2ae0635f189d836f67024904", "status": "affected", "versionType": "git" }, { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "7673030efe0f8ca1056d3849d61784c6caa052af", "status": "affected", "versionType": "git" }, { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "7922b1f058fe24a93730511dd0ae2e1630920096", "status": "affected", "versionType": "git" }, { "version": "c3e9f888263bb4df11cbd623ceced02081cb2f9f", "lessThan": "8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/afs/afs.h", "fs/afs/afs_vl.h", "fs/afs/vl_alias.c", "fs/afs/vlclient.c" ], "versions": [ { "version": "5.8", "status": "affected" }, { "version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.234", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.177", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.125", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.72", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.10", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.234" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.177" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.125" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.72" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9340385468d056bb700b8f28df236b81fc86a079" }, { "url": "https://git.kernel.org/stable/c/7cb3e77e9b4e6ffa325a5559393d3283c9af3d01" }, { "url": "https://git.kernel.org/stable/c/aabe47cf5ac5e1db2ae0635f189d836f67024904" }, { "url": "https://git.kernel.org/stable/c/7673030efe0f8ca1056d3849d61784c6caa052af" }, { "url": "https://git.kernel.org/stable/c/7922b1f058fe24a93730511dd0ae2e1630920096" }, { "url": "https://git.kernel.org/stable/c/8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8" } ], "title": "afs: Fix the maximum cell name length", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:58:26.381Z" } } ] } }