{"id":"CVE-2026-74427","state":"PUBLISHED","title":"afs: Fix netns teardown to cancel the preallocation charger","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review).","publishedAt":"2026-08-15T05:59:29.053Z","updatedAt":"2026-10-16T19:05:44.869Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"85d5fb80fe4f0cc836b6df83f26de204fe102ff7","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"a33975ff2b6ea47b8f29956403374b1cdd057539","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"b83ecf80e28afb7b6595ba79932e77ca68a5a83d","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"eec89c5f8e1adc1de4824042ef75f62aed804153","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"47694fbc9d24ab6bf210f91e8efe06a10a478064","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.9","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"]}],"references":["https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9","https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1","https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a","https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7","https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539","https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d","https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153","https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74427.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74427","state":"PUBLISHED","datePublished":"2026-08-15T05:59:29.053Z","dateUpdated":"2026-10-16T19:05:44.869Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.895Z"},"containers":{"cna":{"title":"afs: Fix netns teardown to cancel the preallocation charger","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review)."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"85d5fb80fe4f0cc836b6df83f26de204fe102ff7","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"a33975ff2b6ea47b8f29956403374b1cdd057539","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"b83ecf80e28afb7b6595ba79932e77ca68a5a83d","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"eec89c5f8e1adc1de4824042ef75f62aed804153","versionType":"git"},{"version":"00e907127e6f86d0f9b122d9b4347a8aa09a8b61","status":"affected","lessThan":"47694fbc9d24ab6bf210f91e8efe06a10a478064","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.9","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/afs/rxrpc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"},{"url":"https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"},{"url":"https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"},{"url":"https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"},{"url":"https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"},{"url":"https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"},{"url":"https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"},{"url":"https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Remote RxRPC/UDP traffic to the kafs callback manager on port 7001 reaches afs_rx_new_call through rxrpc incoming-call processing and can requeue charge_preallocation_work that touches per-net AFS state during namespace teardown, matching other network-reachable netns-teardown UAF bugs.\nAC:L - The attacker controls both sides of the race—namespace create/destroy timing via user namespaces or container lifecycle, plus concurrent RxRPC callback floods—and the follow-up fix confirms incoming I/O-thread calls can requeue the charger after listen(0); the window is wide and repeatable.\nPR:N - afs_rx_new_call is invoked during RXRPC_CONN_SERVICE_CHALLENGING before AFS credential verification completes, so a remote peer sending valid CM-service RxRPC DATA can drive the bug; alternatively an unprivileged user obtains CAP_NET_ADMIN via user namespaces to destroy the namespace.\nUI:N - No victim interaction such as mounting AFS volumes or opening files is required; exploitation relies on attacker-driven namespace teardown and/or RxRPC packets, both kernel-level events under attacker or infrastructure control.\nS:U - The UAF corrupts kernel heap objects within the same OS security authority; impact does not cross a VM, IOMMU, or KVM/Xen boundary into a separate security domain.\nC:H - charge_preallocation_work on afs_wq dereferences freed struct afs_net fields (socket, spare_incoming_call, nr_outstanding_calls) after per-net exit; UAF of slab objects enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Continued charging and afs_alloc_call through freed afs_net writes into stale per-net counters and socket state; UAF supports heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - Use-after-free on afs_net and its RxRPC socket during teardown causes kernel oops or panic; even without full exploitation the race reliably crashes the host and can be retriggered on demand."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:47:02.011Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74427","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:56:19.118841Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:05:44.869Z"}}]}}}