Linux Kernel CVE-2026-74429

The target system must be actively running an AFS filesystem client that uses the rxrpc protocol - this is a non-default Linux configuration requiring explicit installation and mounting of AFS volumes (via the kafs or openafs kernel modules). The vulnerability is triggered when: (1) an rxrpc client call is initiated, and (2) a reply DATA packet reaches rxrpc_receiving_reply() before the call has been 'exposed' - meaning before the first outbound request DATA packet is transmitted. The attacker must be in a position to deliver this premature reply, requiring either control of the AFS server being contacted or the ability to inject/forge UDP packets on the network path (MITM). Limiting factors: systems not using AFS or rxrpc have zero exposure regardless of kernel version; the timing window between call initiation and first request packet transmission constrains opportunistic exploitation; no exploitation path exists against arbitrary Linux systems via AV:N without rxrpc being in active client use.

The vendor-assigned CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-accessible, unauthenticated denial-of-service with high availability impact. However, several signals jointly reduce real-world priority for most organizations. First, exploitation is gated on the target actively running an rxrpc/AFS client - a non-default Linux configuration absent from most enterprise and cloud workloads. Second, EPSS at 0.15% (5th percentile) strongly corroborates the absence of in-the-wild exploitation activity. Third, there is no CISA KEV entry and no public POC. Fourth, the 'Information Disclosure' tag in the ENISA intelligence data conflicts directly with the CVSS vector (C:N) and the description - this tag appears to be a misclassification and should not influence triage. The AC:L rating in the provided vector may also overstate ease: the attacker must control an AFS server or be positioned for MITM to inject a premature reply with correct timing, suggesting AC:H in practice. Real-world priority: low for general Linux deployments, medium for environments running AFS clients where patching cadence is slow.

An attacker operating a malicious AFS server - or conducting a man-in-the-middle attack on AFS UDP traffic - waits for a Linux AFS client to initiate an rxrpc client call, then immediately injects or returns a reply DATA packet before the client has transmitted any request DATA packets. This premature reply reaches rxrpc_receiving_reply() while the call is in the unexposed state, triggering rxrpc_rotate_tx_window() against an empty transmit queue, causing a kernel oops and crashing the target system. No public POC has been identified at time of analysis.