This CVE exposes a subtle but critical lifecycle management bug in the AFS filesystem. When an inode is freed and the slab allocator reuses it, the work_struct embedded in the inode (lock_work) is not reinitialized — the slab's init function runs, but work_struct requires explicit initialization via INIT_WORK, not just zeroing. This manifests as an ODEBUG warning during inode eviction and reuse races, specifically triggered by the generic/131 xfstest which exercises file locking paths hard enough to expose the race condition.
What makes this dangerous is that DEBUG_OBJECTS — which catches the warning — is typically disabled in production kernels. Without it, the bug produces silent memory corruption: a stale work_struct fires against a reallocated inode, operating on state that now belongs to a different file entirely. The practical impact is corrupted file lock state or mysterious inode refcount issues that manifest long after the actual corruption event.
The fix is straightforward but must be applied in two places: reinitialize the work_struct at allocation time (not relying on slab init), and flush any pending work during inode eviction. This is a narrow fix for this specific bug, but the pattern is almost certainly present elsewhere. Any kernel subsystem embedding work_structs inside slab-allocated objects that can be freed and reused is potentially vulnerable. The audit path is straightforward — search for work_struct members in inode, dentry, or similar reusable structures and verify explicit INIT_WORK at allocation and cancel_work_sync at destruction.
Do not treat the ODEBUG warning as the failure mode. The real failure mode is silent data corruption in production where debug object tracking is disabled.