{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74427","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.895Z","datePublished":"2026-08-15T05:59:29.053Z","dateUpdated":"2026-08-17T05:47:02.011Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:47:02.011Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Remote RxRPC/UDP traffic to the kafs callback manager on port 7001 reaches afs_rx_new_call through rxrpc incoming-call processing and can requeue charge_preallocation_work that touches per-net AFS state during namespace teardown, matching other network-reachable netns-teardown UAF bugs.\nAC:L - The attacker controls both sides of the race—namespace create/destroy timing via user namespaces or container lifecycle, plus concurrent RxRPC callback floods—and the follow-up fix confirms incoming I/O-thread calls can requeue the charger after listen(0); the window is wide and repeatable.\nPR:N - afs_rx_new_call is invoked during RXRPC_CONN_SERVICE_CHALLENGING before AFS credential verification completes, so a remote peer sending valid CM-service RxRPC DATA can drive the bug; alternatively an unprivileged user obtains CAP_NET_ADMIN via user namespaces to destroy the namespace.\nUI:N - No victim interaction such as mounting AFS volumes or opening files is required; exploitation relies on attacker-driven namespace teardown and/or RxRPC packets, both kernel-level events under attacker or infrastructure control.\nS:U - The UAF corrupts kernel heap objects within the same OS security authority; impact does not cross a VM, IOMMU, or KVM/Xen boundary into a separate security domain.\nC:H - charge_preallocation_work on afs_wq dereferences freed struct afs_net fields (socket, spare_incoming_call, nr_outstanding_calls) after per-net exit; UAF of slab objects enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Continued charging and afs_alloc_call through freed afs_net writes into stale per-net counters and socket state; UAF supports heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - Use-after-free on afs_net and its RxRPC socket during teardown causes kernel oops or panic; even without full exploitation the race reliably crashes the host and can be retriggered on demand."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"],"versions":[{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"85d5fb80fe4f0cc836b6df83f26de204fe102ff7","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"a33975ff2b6ea47b8f29956403374b1cdd057539","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"b83ecf80e28afb7b6595ba79932e77ca68a5a83d","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"eec89c5f8e1adc1de4824042ef75f62aed804153","status":"affected","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","lessThan":"47694fbc9d24ab6bf210f91e8efe06a10a478064","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"],"versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"},{"url":"https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"},{"url":"https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"},{"url":"https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"},{"url":"https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"},{"url":"https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"},{"url":"https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"},{"url":"https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"}],"title":"afs: Fix netns teardown to cancel the preallocation charger","x_generator":{"engine":"bippy-1.2.0"}}}}