Linux Kernel AFS Vulnerability in Server Handling

CVE-2025-40010

What is CVE-2025-40010?

A vulnerability in the Linux kernel's AFS module has been identified, where the function afs_put_server() improperly accessed server->debug_id without verifying if the pointer was NULL. This scenario can potentially lead to a null pointer dereference, causing system instability or crashes. The issue has been addressed by adjusting the code to ensure that the debug_id assignment occurs only after confirming that the server pointer is valid, thus preventing any unauthorized memory access.

References