In the Linux kernel, the following vulnerability has been resolved:
afs: Fix the maximum cell name length
The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning:
WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405
because procfs limits the maximum filename length to 255.
However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL).
Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.
Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cb3e77e9b4e6ffa325a5559393d3283c9af3d01", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-00f83ed6" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabe47cf5ac5e1db2ae0635f189d836f67024904", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-01c7ca04" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9340385468d056bb700b8f28df236b81fc86a079", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-16c72c5e" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9340385468d056bb700b8f28df236b81fc86a079", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-1a1a165b" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-2a1e9586" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7922b1f058fe24a93730511dd0ae2e1630920096", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-32d6f8fd" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7922b1f058fe24a93730511dd0ae2e1630920096", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-3c382437" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9340385468d056bb700b8f28df236b81fc86a079", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-47a7d8c0" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-4dc0c665" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-50639519" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cb3e77e9b4e6ffa325a5559393d3283c9af3d01", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-5535cf88" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9340385468d056bb700b8f28df236b81fc86a079", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-69c0a151" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabe47cf5ac5e1db2ae0635f189d836f67024904", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-7a9ad982" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7673030efe0f8ca1056d3849d61784c6caa052af", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-7b9e04d1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7922b1f058fe24a93730511dd0ae2e1630920096", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-82e06698" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7673030efe0f8ca1056d3849d61784c6caa052af", "signature_version": "v1", "target": { "file": "fs/afs/vl_alias.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "93242646668608190310201123383622410351", "204821667257046554684413001578140224656", "49173085652291129178984782894947824617", "295215181797060492279465150450339295728", "164700258929578513590707966925641251854", "302507135577508350344335687873829669520", "299393819597719432910613881367584080987", "150528438016740209565181761478861913166", "61110438243829167287296140981997990572" ] }, "id": "CVE-2025-21646-883797d4" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabe47cf5ac5e1db2ae0635f189d836f67024904", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-8c3d9cc2" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cb3e77e9b4e6ffa325a5559393d3283c9af3d01", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-93d2b6e6" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cb3e77e9b4e6ffa325a5559393d3283c9af3d01", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-97406526" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-c2f522ae" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7922b1f058fe24a93730511dd0ae2e1630920096", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-ca205750" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7673030efe0f8ca1056d3849d61784c6caa052af", "signature_version": "v1", "target": { "file": "fs/afs/vlclient.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "76048950376506039649694612436249371611", "203330924462496174599062404363689928841", "186390635064013568104768743218361236016", "25321181657790455507265584455158654696" ] }, "id": "CVE-2025-21646-df5a6413" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7673030efe0f8ca1056d3849d61784c6caa052af", "signature_version": "v1", "target": { "function": "afs_deliver_yfsvl_get_cell_name", "file": "fs/afs/vlclient.c" }, "digest": { "function_hash": "96376155300373696530311931521992963301", "length": 1036.0 }, "id": "CVE-2025-21646-e3a58493" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabe47cf5ac5e1db2ae0635f189d836f67024904", "signature_version": "v1", "target": { "function": "yfs_check_canonical_cell_name", "file": "fs/afs/vl_alias.c" }, "digest": { "function_hash": "148240004451254762078106120447345923048", "length": 431.0 }, "id": "CVE-2025-21646-fed07146" } ]