The vulnerability in the Linux kernel's AFS subsystem involves the delayed allocation of a cell's anonymous key, which is performed in a background thread alongside other cell setup tasks. When afs_parse_source() parses the device name and calls afs_lookup_cell(), the normal key lookup may attempt to use the anonymous key's description before it is set, leading to a kernel oops. The fix includes pre-allocating a reference name attached to the cell record, on-demand allocation of the anonymous key with mutex protection to avoid multiple allocations, and modifying afs_request_key_rcu() to return NULL if the anonymous key is not yet allocated, allowing safe fallback behavior.

This vulnerability can cause a kernel oops (crash) due to referencing an uninitialized anonymous key during key lookup in the AFS subsystem. While no exploits in the wild are known, the impact is a denial of service via kernel instability when mounting or accessing AFS cells under certain conditions.

A fix has been implemented in the Linux kernel to address this issue by changing the allocation timing and synchronization of the anonymous key in the AFS subsystem. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for current remediation guidance.