CVE-2026-80885 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing (typically to respond to security challenges). Also move OOB message processing to afs_wq so that it's also waited for and make the OOB handler just return if the net namespace is no longer live.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/231414253b648b3518b56f09710b831945d6a2fc
https://git.kernel.org/stable/c/a4057e58b07005d0fe0491bdbf1868c1491909ee
https://git.kernel.org/stable/c/d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4

History

Fri, 04 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-789

Fri, 04 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing (typically to respond to security challenges). Also move OOB message processing to afs_wq so that it's also waited for and make the OOB handler just return if the net namespace is no longer live.
Title		afs: Fix uncancelled rxrpc OOB message handler
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/231414253b648b3518b56f09710b831945d6a2fc https://git.kernel.org/stable/c/a4057e58b07005d0fe0491bdbf1868c1491909ee https://git.kernel.org/stable/c/d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T16:49:34.486Z

Updated: 2026-09-04T16:49:34.486Z

Reserved: 2026-08-26T14:34:25.799Z

Link: CVE-2026-80885

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T17:17:01.207

Modified: 2026-09-04T17:17:01.207

Link: CVE-2026-80885

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80885", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.799Z", "datePublished": "2026-09-04T16:49:34.486Z", "dateUpdated": "2026-09-04T16:49:34.486Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-04T16:49:34.486Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix uncancelled rxrpc OOB message handler\n\nFix AFS to cancel its OOB message processing (typically to respond to\nsecurity challenges). Also move OOB message processing to afs_wq so that\nit's also waited for and make the OOB handler just return if the net\nnamespace is no longer live."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cm_security.c", "fs/afs/rxrpc.c"], "versions": [{"version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "lessThan": "231414253b648b3518b56f09710b831945d6a2fc", "status": "affected", "versionType": "git"}, {"version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "lessThan": "d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4", "status": "affected", "versionType": "git"}, {"version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "lessThan": "a4057e58b07005d0fe0491bdbf1868c1491909ee", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/cm_security.c", "fs/afs/rxrpc.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/231414253b648b3518b56f09710b831945d6a2fc"}, {"url": "https://git.kernel.org/stable/c/d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4"}, {"url": "https://git.kernel.org/stable/c/a4057e58b07005d0fe0491bdbf1868c1491909ee"}], "title": "afs: Fix uncancelled rxrpc OOB message handler", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/cm_security.c", "fs/afs/rxrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "231414253b648b3518b56f09710b831945d6a2fc", "status": "affected", "version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "versionType": "git"}, {"lessThan": "d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4", "status": "affected", "version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "versionType": "git"}, {"lessThan": "a4057e58b07005d0fe0491bdbf1868c1491909ee", "status": "affected", "version": "5800b1cf3fd8ccab752a101865be1e76dac33142", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/cm_security.c", "fs/afs/rxrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix uncancelled rxrpc OOB message handler\n\nFix AFS to cancel its OOB message processing (typically to respond to\nsecurity challenges). Also move OOB message processing to afs_wq so that\nit's also waited for and make the OOB handler just return if the net\nnamespace is no longer live."}], "id": "CVE-2026-80885", "lastModified": "2026-09-04T17:17:01.207", "metrics": {}, "published": "2026-09-04T17:17:01.207", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/231414253b648b3518b56f09710b831945d6a2fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4057e58b07005d0fe0491bdbf1868c1491909ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}