CVE-2026-74426 (GCVE-0-2026-74426)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:19
VLAI
Title
afs: fix NULL pointer dereference in afs_get_tree()
Summary
In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs_get_tree() afs_alloc_sbi() uses kzalloc for memory allocation. And, if ctx->dyn_root is not null, as->cell and as->volume are null. In trace_afs_get_tree() they are dereferenced. KASAN error message: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550 include/trace/events/afs.h:1365 Call Trace: trace_afs_get_tree include/trace/events/afs.h:1365 [inline] afs_get_tree+0x922/0x1350 fs/afs/super.c:599 vfs_get_tree+0x8e/0x300 fs/super.c:1572 do_new_mount fs/namespace.c:3011 [inline] path_mount+0x14a5/0x2220 fs/namespace.c:3341 do_mount fs/namespace.c:3354 [inline] __do_sys_mount fs/namespace.c:3562 [inline] __se_sys_mount fs/namespace.c:3539 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3539 do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < 67fb48c4a0874953212321cd5d57fdb4900dbc31 (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < d648cc2069eb081707c061849046d909f57c78b1 (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < d5b17474feed3c30991f07affa2473adbad95055 (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < 867b3ea146a041023bfcd258e6db516b1bb28f19 (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < ea19edf71721cd42f923e3c70f4ff995b422fe3b (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < 23b3d457d8387bcb2a61063a9e520063ada9335f (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < 70b2842734d831c908474779bb8a76daf55f782c (git)
Affected: 80548b03991f58758a336424a90bf9f988e3b077 , < 0b70716081c6462be9b2928ad736d0d527b09678 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67fb48c4a0874953212321cd5d57fdb4900dbc31",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "d648cc2069eb081707c061849046d909f57c78b1",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "d5b17474feed3c30991f07affa2473adbad95055",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "867b3ea146a041023bfcd258e6db516b1bb28f19",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "ea19edf71721cd42f923e3c70f4ff995b422fe3b",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "23b3d457d8387bcb2a61063a9e520063ada9335f",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "70b2842734d831c908474779bb8a76daf55f782c",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            },
            {
              "lessThan": "0b70716081c6462be9b2928ad736d0d527b09678",
              "status": "affected",
              "version": "80548b03991f58758a336424a90bf9f988e3b077",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: fix NULL pointer dereference in afs_get_tree()\n\nafs_alloc_sbi() uses kzalloc for memory allocation. And, if\nctx-\u003edyn_root is not null, as-\u003ecell and as-\u003evolume are null.\nIn trace_afs_get_tree() they are dereferenced.\n\nKASAN error message:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1\n04/01/2014\nRIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550\ninclude/trace/events/afs.h:1365\n\nCall Trace:\ntrace_afs_get_tree include/trace/events/afs.h:1365 [inline]\nafs_get_tree+0x922/0x1350 fs/afs/super.c:599\nvfs_get_tree+0x8e/0x300 fs/super.c:1572\ndo_new_mount fs/namespace.c:3011 [inline]\npath_mount+0x14a5/0x2220 fs/namespace.c:3341\ndo_mount fs/namespace.c:3354 [inline]\n__do_sys_mount fs/namespace.c:3562 [inline]\n__se_sys_mount fs/namespace.c:3539 [inline]\n__x64_sys_mount+0x283/0x300 fs/namespace.c:3539\n do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46\nentry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:19:11.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67fb48c4a0874953212321cd5d57fdb4900dbc31"
        },
        {
          "url": "https://git.kernel.org/stable/c/d648cc2069eb081707c061849046d909f57c78b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5b17474feed3c30991f07affa2473adbad95055"
        },
        {
          "url": "https://git.kernel.org/stable/c/867b3ea146a041023bfcd258e6db516b1bb28f19"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea19edf71721cd42f923e3c70f4ff995b422fe3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/23b3d457d8387bcb2a61063a9e520063ada9335f"
        },
        {
          "url": "https://git.kernel.org/stable/c/70b2842734d831c908474779bb8a76daf55f782c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b70716081c6462be9b2928ad736d0d527b09678"
        }
      ],
      "title": "afs: fix NULL pointer dereference in afs_get_tree()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74426",
    "datePublished": "2026-08-15T05:59:28.427Z",
    "dateReserved": "2026-08-15T05:44:03.894Z",
    "dateUpdated": "2026-08-17T05:19:11.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74426",
      "date": "2026-09-21",
      "epss": "0.00165",
      "percentile": "0.06168"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "67fb48c4a0874953212321cd5d57fdb4900dbc31",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d648cc2069eb081707c061849046d909f57c78b1",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5b17474feed3c30991f07affa2473adbad95055",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "867b3ea146a041023bfcd258e6db516b1bb28f19",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea19edf71721cd42f923e3c70f4ff995b422fe3b",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23b3d457d8387bcb2a61063a9e520063ada9335f",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "70b2842734d831c908474779bb8a76daf55f782c",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b70716081c6462be9b2928ad736d0d527b09678",
                    "status": "affected",
                    "version": "80548b03991f58758a336424a90bf9f988e3b077",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: fix NULL pointer dereference in afs_get_tree()\n\nafs_alloc_sbi() uses kzalloc for memory allocation. And, if\nctx-\u003edyn_root is not null, as-\u003ecell and as-\u003evolume are null.\nIn trace_afs_get_tree() they are dereferenced.\n\nKASAN error message:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1\n04/01/2014\nRIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550\ninclude/trace/events/afs.h:1365\n\nCall Trace:\ntrace_afs_get_tree include/trace/events/afs.h:1365 [inline]\nafs_get_tree+0x922/0x1350 fs/afs/super.c:599\nvfs_get_tree+0x8e/0x300 fs/super.c:1572\ndo_new_mount fs/namespace.c:3011 [inline]\npath_mount+0x14a5/0x2220 fs/namespace.c:3341\ndo_mount fs/namespace.c:3354 [inline]\n__do_sys_mount fs/namespace.c:3562 [inline]\n__se_sys_mount fs/namespace.c:3539 [inline]\n__x64_sys_mount+0x283/0x300 fs/namespace.c:3539\n do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46\nentry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
          }
        ],
        "id": "CVE-2026-74426",
        "lastModified": "2026-08-17T06:19:38.110",
        "metrics": {},
        "published": "2026-08-15T06:22:44.690",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b70716081c6462be9b2928ad736d0d527b09678"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23b3d457d8387bcb2a61063a9e520063ada9335f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67fb48c4a0874953212321cd5d57fdb4900dbc31"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/70b2842734d831c908474779bb8a76daf55f782c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/867b3ea146a041023bfcd258e6db516b1bb28f19"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5b17474feed3c30991f07affa2473adbad95055"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d648cc2069eb081707c061849046d909f57c78b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea19edf71721cd42f923e3c70f4ff995b422fe3b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T11:00:03+00:00",
      "cve": "CVE-2026-74426",
      "id": "CVE-2026-74426",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: afs: fix NULL pointer dereference in afs_get_tree()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74426.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:21:18Z",
      "cve": "CVE-2026-74426",
      "id": "CVE-2026-74426",
      "initial_release_date": "2026-08-25T01:20:47Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74426",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74426.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.