Linux Kernel EUVD-2026-59271

The Andrew File System client subsystem (kafs) in the Linux kernel maintains per-network-namespace cell tracking through the net->cells_dyn_ino field. Modifications to this field were performed without holding the net->cells_lock read-write semaphore exclusively, creating an unprotected concurrent write path. The root cause is a missing synchronization primitive - analogous to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) - in kernel space, where concurrent cell registration and teardown operations race on shared mutable state. A secondary constraint is that afs_cell_destroy() runs in RCU cleanup context, where sleeping locks cannot be acquired; the correct fix relocates net->cells_dyn_ino removal to afs_destroy_cell_work(), which executes in a workqueue context where sleeping is permitted. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms this spans the mainline Linux kernel across multiple stable branches including 6.12.x, 6.18.x, and 7.1.x.