CVE-2026-80885 afs: Fix uncancelled rxrpc OOB message handler
A race condition in the Linux kernel AFS module can lead to a denial of service due to uncancelled OOB message handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80885?
CVE-2026-80885 is a vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix uncancelled rxrpc OOB message handler
Fix AFS to cancel its OOB message processing (typically to respond to security challenges). Also move OOB message processing to afs_wq so that it's also waited for and make the OOB handler just return if the net namespace is no longer live.
Which versions are affected by CVE-2026-80885?
How do I fix CVE-2026-80885?
Apply the vendor's patch.
Is CVE-2026-80885 being exploited?
There is no known exploitation of CVE-2026-80885 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80885, DEBIAN-CVE-2026-80885, GHSA-xpmh-9jmc-8fp5, UBUNTU-CVE-2026-80885.