{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74427", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.895Z", "datePublished": "2026-08-15T05:59:29.053Z", "dateUpdated": "2026-08-17T05:47:02.011Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:47:02.011Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote RxRPC/UDP traffic to the kafs callback manager on port 7001 reaches afs_rx_new_call through rxrpc incoming-call processing and can requeue charge_preallocation_work that touches per-net AFS state during namespace teardown, matching other network-reachable netns-teardown UAF bugs.\nAC:L - The attacker controls both sides of the race\u2014namespace create/destroy timing via user namespaces or container lifecycle, plus concurrent RxRPC callback floods\u2014and the follow-up fix confirms incoming I/O-thread calls can requeue the charger after listen(0); the window is wide and repeatable.\nPR:N - afs_rx_new_call is invoked during RXRPC_CONN_SERVICE_CHALLENGING before AFS credential verification completes, so a remote peer sending valid CM-service RxRPC DATA can drive the bug; alternatively an unprivileged user obtains CAP_NET_ADMIN via user namespaces to destroy the namespace.\nUI:N - No victim interaction such as mounting AFS volumes or opening files is required; exploitation relies on attacker-driven namespace teardown and/or RxRPC packets, both kernel-level events under attacker or infrastructure control.\nS:U - The UAF corrupts kernel heap objects within the same OS security authority; impact does not cross a VM, IOMMU, or KVM/Xen boundary into a separate security domain.\nC:H - charge_preallocation_work on afs_wq dereferences freed struct afs_net fields (socket, spare_incoming_call, nr_outstanding_calls) after per-net exit; UAF of slab objects enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Continued charging and afs_alloc_call through freed afs_net writes into stale per-net counters and socket state; UAF supports heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - Use-after-free on afs_net and its RxRPC socket during teardown causes kernel oops or panic; even without full exploitation the race reliably crashes the host and can be retriggered on demand."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/rxrpc.c"], "versions": [{"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "85d5fb80fe4f0cc836b6df83f26de204fe102ff7", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "a33975ff2b6ea47b8f29956403374b1cdd057539", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "b83ecf80e28afb7b6595ba79932e77ca68a5a83d", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "eec89c5f8e1adc1de4824042ef75f62aed804153", "status": "affected", "versionType": "git"}, {"version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "lessThan": "47694fbc9d24ab6bf210f91e8efe06a10a478064", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/rxrpc.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"}, {"url": "https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"}, {"url": "https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"}, {"url": "https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"}, {"url": "https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"}, {"url": "https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"}, {"url": "https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"}, {"url": "https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"}], "title": "afs: Fix netns teardown to cancel the preallocation charger", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/rxrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "85d5fb80fe4f0cc836b6df83f26de204fe102ff7", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "a33975ff2b6ea47b8f29956403374b1cdd057539", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "b83ecf80e28afb7b6595ba79932e77ca68a5a83d", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "eec89c5f8e1adc1de4824042ef75f62aed804153", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}, {"lessThan": "47694fbc9d24ab6bf210f91e8efe06a10a478064", "status": "affected", "version": "00e907127e6f86d0f9b122d9b4347a8aa09a8b61", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/rxrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."}], "id": "CVE-2026-74427", "lastModified": "2026-08-17T06:19:38.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:44.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: Fix netns teardown to cancel the preallocation charger", "id": "2516783", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516783"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nafs: Fix netns teardown to cancel the preallocation charger\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n(This was found by AI review).", "A flaw was found in the AFS (Andrew File System) component of the Linux kernel. During the teardown of an AFS network namespace, a work item responsible for managing preallocated resources (rxrpc call/connection/peer queue) may not be properly canceled. This improper resource handling could lead to a resource leak, potentially resulting in a Denial of Service (DoS) due to resource exhaustion."], "name": "CVE-2026-74427", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74427\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74427\nhttps://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-74427-59f7@gregkh/T"], "threat_severity": "Moderate"}