Linux Kernel EUVD-2026-86891

Requires the host to have an AFS (Andrew File System) volume mounted using the kernel afs/rxrpc stack, and an AFS fileserver address-list refresh (afs_fs_probe_fileserver) that removes a peer, concurrent with an incoming RxRPC callback that still pins the old peer after the server object is RCU-freed. Exploitation is bounded by this multi-event timing race (AC:H) which is not directly attacker-steerable, and by the fact that AFS is an uncommon deployment; there is no single-request network trigger despite the AV:N in the NVD vector.

This is a Linux kernel use-after-free (effectively CWE-416; CVE feed lists CWE as N/A) in the AFS filesystem client's peer/endpoint address-refresh logic, resolved upstream. NVD's 7.5 CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) with full C:H/I:H/A:H overstates real-world risk. The bug is a race between an AFS server address-list replacement, RCU freeing of the server object, and an incoming RxRPC callback that still pins the old peer and dereferences its freed app_data - none of these steps are attacker-controlled in the classic remote sense, so AC:H is warranted but PR:N/AV:N/C:H/I:H are generous. The realistic impact is a KASAN-detected slab-use-after-free leading to a crash (DoS); the C:H/I:H claims are not supported by the description, which shows only a read of a freed 4-byte field feeding afs_find_server/afs_use_server. Prioritization signals are weak: no EPSS score, no CISA KEV listing, and no public exploit - so exploitation status is 'no public exploit identified.' This is a low-priority, patch-in-normal-cycle kernel hardening fix for the niche subset of systems that actually mount AFS, not an urgent network-exploitable RCE despite the high headline CVSS.

On a host with a mounted AFS volume, a fileserver address refresh replaces server S's address list without clearing the old peer's app_data; after S is freed via its RCU callback, an incoming RxRPC callback that still references the old peer reads its stale app_data and invokes afs_use_server()/afs_find_server() on the freed object, tripping a slab-use-after-free and likely crashing the kernel. Triggering this reliably requires winning a narrow teardown/refresh timing window rather than sending a single crafted packet, and no public exploit or POC exists.