EUVD-2026-59574
GHSA-2hj8-22xr-w775
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local netns-teardown race in an optional module needing some privilege to trigger (PR:L) and a timing window (AC:H); primary impact is use-after-free crash/DoS (A:H), with C/I not clearly demonstrated.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix netns teardown to cancel the preallocation charger
Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls are disabled (i.e. listen 0).
Also, if net->live is false because the afs netns is being deleted, make afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid requeuing the charger.
(This was found by AI review).
AnalysisAI
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the kAFS filesystem client to be in use: the kafs module loaded and an AFS network namespace being torn down (net->live false, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) is inconsistent with the actual defect: this is a network-namespace teardown race in an optional filesystem module, not a remotely reachable unauthenticated RCE - treat the 9.8 as the automated Linux-kernel default rather than a validated real-world score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host that uses the kAFS client, a local user (or container) with the ability to create and rapidly tear down network namespaces triggers repeated afs netns deletion while the rxrpc preallocation charger is still queued. By racing teardown against the charger work item, the attacker causes the kernel to operate on freed AFS/rxrpc state, yielding a use-after-free that can crash the system or potentially be shaped toward memory corruption. … |
| Remediation | Vendor-released patch: update to a kernel that includes the fix for your series - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1 (fix commits at https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153 and siblings). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kAFS and determine current kernel versions to assess exposure to CVE-2026-74427. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today