Linux Kernel CVE-2026-74425

Exploitation requires that the target system has the Linux kernel's AFS client module (kafs) loaded and AFS configured - neither condition is present in default Linux installations on any major distribution. The attacker must be able to reach the AFS callback service port (typically UDP 7001) on the target host. The vulnerability is specifically triggered when a CB.InitCallBackState3 callback request arrives on an rxrpc peer that has no server record associated with it, a condition inducible by sending a callback request outside the context of an established AFS server association. Limiting factors: AFS must be explicitly installed and configured (non-default); the AFS module must be loaded at the time of the attack; and the attacker must have network-level reachability to the AFS callback port. Systems not running AFS are entirely unaffected regardless of kernel version.

The NVD-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a 7.5 score that overstates practical risk. The network vector and lack of required privileges are technically accurate - an attacker can send crafted UDP packets without authenticating - but the score treats AFS as universally deployed, which it is not. AFS is a non-default, niche distributed filesystem rarely present outside academic, research, or legacy enterprise environments. EPSS at 0.16% (5th percentile) is consistent with this limited exposure surface. There is no CISA KEV listing and no public POC or exploit code identified, meaning this is no public exploit identified at time of analysis. The provided intelligence tags this as 'Information Disclosure,' which directly conflicts with CVSS C:N and the technical description, which describes only an availability impact from a missing server record check - the 'Information Disclosure' tag appears to be a mis-classification error and should not factor into triage decisions. Cross-referencing all signals: high theoretical CVSS, very low EPSS, no active exploitation, niche technology prerequisite, and a straightforward patch available - this is a low operational priority for most organizations.

An attacker with network access to a Linux host that has AFS configured and the kafs module loaded sends a crafted CB.InitCallBackState3 packet to the AFS cache manager service on that host. The packet arrives on an rxrpc peer that has no server record mapped to it, triggering the unguarded code path. The kernel dereferences an invalid or null pointer, resulting in a kernel oops, panic, or AFS subsystem failure, taking the host offline or disrupting AFS-dependent services. No public POC has been identified, and the attack is practically constrained to environments where AFS is actively deployed.