CVE-2026-97585 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and security teams responsible for managing Linux kernel deployments. These stakeholders should review the patch notes, verify the afs_edit_dir_remove() function implementation, and monitor for potential issues with the afs_dir_find_block() function to ensure the vulnerability is properly addressed.

Why it matters

The CVE-2026-97585 vulnerability in the Linux kernel's afs_edit_dir_remove() function requires verification of patch implementation to prevent double-unmap issues. Linux kernel developers and maintainers should review the patch notes and verify the afs_edit_dir_remove() function implementation.

• Verify Linux kernel patch implementation to prevent double-unmap issues
• Monitor for potential issues with afs_dir_find_block() function

Technical summary

The Linux kernel's afs_edit_dir_remove() function has a double-unmap vulnerability. The function fails to use a cleanup function to unmap the block pointed to by afs_dir_iter::block, leading to potential double-kunmap issues. This vulnerability can be triggered when afs_dir_find_block() is called twice in a row, resulting in a double-kunmap of the same block. To address this issue, Linux kernel developers and maintainers should review the patch notes and verify the afs_edit_dir_remove() function implementation to ensure the vulnerability is properly addressed.

Defensive priority

Low

Recommended defensive actions

• Review Linux kernel patch notes for CVE-2026-97585
• Verify afs_edit_dir_remove() function implementation
• Monitor for potential double-unmap issues in Linux kernel
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes and Git commit history are available for further analysis. To verify the patch implementation, defenders should review the official advisory, check for affected product deployments, and monitor for potential issues with the afs_dir_find_block() function. Additional analysis of the Linux kernel source code and patch implementation may be necessary to ensure the vulnerability is fully addressed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.