{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  afs: Clear stale peer app data after address list changes  afs_fs_probe_fileserver() fetches the current endpoint state under server-\u003efs_lock, but leaves old_alist as NULL.  Consequently, afs_set_peer_appdata() treats every address list replacement as initial setup and only binds the new peers; it never unbinds peers removed from the old list.  An address refresh can therefore proceed as follows.  CPU 0 replaces server S's list and drops Pold without clearing Pold-\u003eapp_data.  The server destroyer then clears only S's current peers and lets S reach its RCU callback.  After the callback frees S, CPU 1 handles a callback through an RxRPC connection that still pins Pold, reads Pold-\u003eapp_data, and calls afs_use_server() on the freed object.  KASAN reported:    BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0   Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74   Call Trace:    afs_find_server+0x3c/0xa0    afs_rx_new_call+0x15c/0x390    rxrpc_new_incoming_call+0x97c/0x1730    rxrpc_input_packet.constprop.0+0xd03/0xec0    rxrpc_io_thread+0x967/0x1640   Allocated by task 93:    afs_lookup_server+0x1a7/0x14c0    afs_alloc_server_list+0x43f/0xb60    afs_create_volume+0x923/0x1490    afs_get_tree+0x1c6/0x10a0   Freed by task 0:    kfree+0x131/0x3c0    rcu_core+0x50a/0x1850   Last potentially related work creation:    __call_rcu_common.constprop.0+0x71/0xa10    afs_put_server+0x213/0x2b0  Preserve old-\u003eaddresses for the peer app-data update so that removed peers are cleared before the endpoint state is replaced.  Also advance both cursors when the old and new lists share a peer; activating the old/new comparison without this would otherwise loop forever on the shared entry.",
  "id": "DEBIAN-CVE-2026-97583",
  "modified": "2026-09-26T04:47:36.033549564Z",
  "published": "2026-09-25T11:17:09.127Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-97583"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-97583"
  ]
}