# afs: Fix vllist leak

CVE record · `CVE-2026-80877`

- **Identifiers:** `CVE-2026-80877`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 4 Sept 2026
- **Updated:** 4 Sept 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 4 Sept 2026, 16:48 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before 13403945c2385653e282dacda304dce2a25fdb53` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before 2b169eedbb96f37f3f33d7b496d8283194988980` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before bf55969d9188380eb539bd216850bac27bc2e272` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before bef5514f6b6cb4bed9061f4b628d6be1cf26a39e` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before fbfe75c81bff2359a03e85cf84293484cf60fcb9` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before 8afb1a787a2802caf1895dd96745cfd6790a6f95` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before 91d8f8e5fd34d3aed26f0fe6cf52b3f71de66cc6` (git)
  - affected: `d5c32c89b208e39a39cd8639aa21c012ce0daf4d to before fc10c0ecf06f2981af5d04357612b00051e03e9e` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.2`
  - unaffected: `before 5.2` (semver)
  - unaffected: `5.10.261 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.212 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.178 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.145 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.97 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.40 to 6.18.*, inclusive` (semver)
  - unaffected: `7.1.5 to 7.1.*, inclusive` (semver)
  - unaffected: `7.2 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 12th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 4 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-80877](https://www.cve.org/CVERecord?id=CVE-2026-80877)
- [NVD: CVE-2026-80877](https://nvd.nist.gov/vuln/detail/CVE-2026-80877)

### References from the CNA

- <https://git.kernel.org/stable/c/13403945c2385653e282dacda304dce2a25fdb53>
- <https://git.kernel.org/stable/c/2b169eedbb96f37f3f33d7b496d8283194988980>
- <https://git.kernel.org/stable/c/bf55969d9188380eb539bd216850bac27bc2e272>
- <https://git.kernel.org/stable/c/bef5514f6b6cb4bed9061f4b628d6be1cf26a39e>
- <https://git.kernel.org/stable/c/fbfe75c81bff2359a03e85cf84293484cf60fcb9>
- <https://git.kernel.org/stable/c/8afb1a787a2802caf1895dd96745cfd6790a6f95>
- <https://git.kernel.org/stable/c/91d8f8e5fd34d3aed26f0fe6cf52b3f71de66cc6>
- <https://git.kernel.org/stable/c/fc10c0ecf06f2981af5d04357612b00051e03e9e>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-80877>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-80877/>. Everything for agents: <https://agentprime.io/llms.txt>.