Linux Kernel CVE-2026-74433

Exploitation requires the target Linux system to have AF_RXRPC loaded and actively using the rxgk (GSS/Kerberos) security class - i.e., a kAFS/AFS deployment - and to reach the rxgk_issue_challenge() path during Rx connection challenge issuance with the relevant rxrpc tracepoint enabled/consumed. Limiting factors: the vulnerable code is not exercised on the vast majority of Linux systems that do not run rxrpc/AFS, the use-after-free window is a timing-sensitive read of a just-freed page (raising practical attack complexity above the CVSS AC:L rating), and realistic impact skews toward information disclosure or denial of service rather than confirmed remote code execution.

The recorded CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the common NVD-style auto-maximized score for kernel CVEs and materially overstates real-world risk here. Contradicting signals: EPSS is only 0.15% (5th percentile), the vulnerability is NOT on CISA KEV, no POC is referenced, and the source tag characterizes impact as 'Information Disclosure' rather than remote code execution - inconsistent with the C:H/I:H maximums in the vector. Crucially, the vector's AC:L is questionable because a use-after-free reached through a tracepoint read is timing/race dependent and, more importantly, requires the niche rxgk security class to be in use, which the CVSS vector does not capture. Realistic impact is more plausibly kernel memory disclosure or a crash/DoS than reliable full-system compromise. This should be treated as routine kernel patch hygiene, not an emergency: patch on your normal cadence unless you specifically run kAFS/rxgk workloads.

An attacker able to speak the Rx protocol to a target running kAFS/rxgk initiates connection setup so the server calls rxgk_issue_challenge(), racing to influence or observe the freed page as the tracepoint reads whdr from memory that has already been released. Success would most plausibly leak fragments of kernel memory or crash the machine rather than yield reliable code execution, and no public exploit is known to exist.