Linux Kernel EUVD-2026-59274

Exploitation requires all of the following: (1) the target system must have the AFS (Andrew File System) kernel module loaded and an AFS filesystem must be mounted and accessible to the attacker; (2) the attacker must have a local shell with at least low-privilege (unprivileged user) access on the host - remote unauthenticated exploitation is not possible; (3) the attacker must perform POSIX file lock operations (e.g., via fcntl SETLK/SETLKW) on an AFS-backed file whose underlying inode was recycled from the kernel slab cache without re-initialization. Exploitation is limited by: AFS being a non-default, rarely deployed filesystem (not mounted by default on any major Linux distribution); the need for existing local code execution; and the timing dependency on slab inode reuse. Systems that do not mount AFS are entirely unaffected regardless of kernel version.

The provided CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is plausible for a kernel-level memory mismanagement flaw, but real-world exploitation risk is significantly lower than the score suggests. EPSS at 0.21% (11th percentile) corroborates this: despite the kernel context and high CIA impact rating, this vulnerability is not being actively targeted. It is not listed in CISA KEV, and no POC has been identified. The CVSS vector indicates local access with low privilege, meaning an attacker must already have a shell on the system and must be able to access an AFS-mounted filesystem - a relatively uncommon enterprise configuration. The AC:L rating may overstate ease of exploitation; triggering inode reuse at the right moment requires specific timing, though the xfstest suite does reproduce it reliably. SSVC assessment: exploitation status is none; the attack is NOT automatable (requires specific filesystem access); technical impact is total (kernel context). Real-world priority should be moderate: patch in normal maintenance cycles unless AFS is actively deployed in the environment, in which case it warrants faster remediation.

A low-privileged local user with access to an AFS-mounted filesystem opens an AFS file and performs POSIX file locking via fcntl(). When the kernel allocates a reused inode from the slab cache without properly reinitializing lock_work, releasing the file lock causes afs_fl_release_private() to queue work on a stale or uninitialized work_struct. On production kernels without DEBUG_OBJECTS, this results in a kernel memory corruption condition that may crash the host or, with careful timing and exploitation technique, allow privilege escalation to root.