CVE-2026-74427 (GCVE-0-2026-74427)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:47
VLAI
Title
afs: Fix netns teardown to cancel the preallocation charger
Summary
In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls are disabled (i.e. listen 0). Also, if net->live is false because the afs netns is being deleted, make afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid requeuing the charger. (This was found by AI review).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9 (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1 (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 85d5fb80fe4f0cc836b6df83f26de204fe102ff7 (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < a33975ff2b6ea47b8f29956403374b1cdd057539 (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < b83ecf80e28afb7b6595ba79932e77ca68a5a83d (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < eec89c5f8e1adc1de4824042ef75f62aed804153 (git)
Affected: 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 , < 47694fbc9d24ab6bf210f91e8efe06a10a478064 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/rxrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "85d5fb80fe4f0cc836b6df83f26de204fe102ff7",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "a33975ff2b6ea47b8f29956403374b1cdd057539",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "b83ecf80e28afb7b6595ba79932e77ca68a5a83d",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "eec89c5f8e1adc1de4824042ef75f62aed804153",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            },
            {
              "lessThan": "47694fbc9d24ab6bf210f91e8efe06a10a478064",
              "status": "affected",
              "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/rxrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net-\u003elive is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote RxRPC/UDP traffic to the kafs callback manager on port 7001 reaches afs_rx_new_call through rxrpc incoming-call processing and can requeue charge_preallocation_work that touches per-net AFS state during namespace teardown, matching other network-reachable netns-teardown UAF bugs.\nAC:L - The attacker controls both sides of the race\u2014namespace create/destroy timing via user namespaces or container lifecycle, plus concurrent RxRPC callback floods\u2014and the follow-up fix confirms incoming I/O-thread calls can requeue the charger after listen(0); the window is wide and repeatable.\nPR:N - afs_rx_new_call is invoked during RXRPC_CONN_SERVICE_CHALLENGING before AFS credential verification completes, so a remote peer sending valid CM-service RxRPC DATA can drive the bug; alternatively an unprivileged user obtains CAP_NET_ADMIN via user namespaces to destroy the namespace.\nUI:N - No victim interaction such as mounting AFS volumes or opening files is required; exploitation relies on attacker-driven namespace teardown and/or RxRPC packets, both kernel-level events under attacker or infrastructure control.\nS:U - The UAF corrupts kernel heap objects within the same OS security authority; impact does not cross a VM, IOMMU, or KVM/Xen boundary into a separate security domain.\nC:H - charge_preallocation_work on afs_wq dereferences freed struct afs_net fields (socket, spare_incoming_call, nr_outstanding_calls) after per-net exit; UAF of slab objects enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Continued charging and afs_alloc_call through freed afs_net writes into stale per-net counters and socket state; UAF supports heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - Use-after-free on afs_net and its RxRPC socket during teardown causes kernel oops or panic; even without full exploitation the race reliably crashes the host and can be retriggered on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:02.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"
        },
        {
          "url": "https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"
        },
        {
          "url": "https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"
        }
      ],
      "title": "afs: Fix netns teardown to cancel the preallocation charger",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74427",
    "datePublished": "2026-08-15T05:59:29.053Z",
    "dateReserved": "2026-08-15T05:44:03.895Z",
    "dateUpdated": "2026-08-17T05:47:02.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74427",
      "date": "2026-09-20",
      "epss": "0.00404",
      "percentile": "0.34444"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/rxrpc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85d5fb80fe4f0cc836b6df83f26de204fe102ff7",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a33975ff2b6ea47b8f29956403374b1cdd057539",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b83ecf80e28afb7b6595ba79932e77ca68a5a83d",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eec89c5f8e1adc1de4824042ef75f62aed804153",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47694fbc9d24ab6bf210f91e8efe06a10a478064",
                    "status": "affected",
                    "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/afs/rxrpc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net-\u003elive is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."
          }
        ],
        "id": "CVE-2026-74427",
        "lastModified": "2026-08-17T06:19:38.237",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:44.810",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:00:52+00:00",
      "cve": "CVE-2026-74427",
      "id": "CVE-2026-74427",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: afs: Fix netns teardown to cancel the preallocation charger",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74427.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:21:16Z",
      "cve": "CVE-2026-74427",
      "id": "CVE-2026-74427",
      "initial_release_date": "2026-08-25T01:20:46Z",
      "product_status:known_affected": "356",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74427",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74427.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.