{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-74427",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-74427"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "afs: Fix netns teardown to cancel the preallocation charger",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review).",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74427"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - Remote RxRPC/UDP traffic to the kafs callback manager on port 7001 reaches afs_rx_new_call through rxrpc incoming-call processing and can requeue charge_preallocation_work that touches per-net AFS state during namespace teardown, matching other network-reachable netns-teardown UAF bugs.\nAC:L - The attacker controls both sides of the race\u2014namespace create/destroy timing via user namespaces or container lifecycle, plus concurrent RxRPC callback floods\u2014and the follow-up fix confirms incoming I/O-thread calls can requeue the charger after listen(0); the window is wide and repeatable.\nPR:N - afs_rx_new_call is invoked during RXRPC_CONN_SERVICE_CHALLENGING before AFS credential verification completes, so a remote peer sending valid CM-service RxRPC DATA can drive the bug; alternatively an unprivileged user obtains CAP_NET_ADMIN via user namespaces to destroy the namespace.\nUI:N - No victim interaction such as mounting AFS volumes or opening files is required; exploitation relies on attacker-driven namespace teardown and/or RxRPC packets, both kernel-level events under attacker or infrastructure control.\nS:U - The UAF corrupts kernel heap objects within the same OS security authority; impact does not cross a VM, IOMMU, or KVM/Xen boundary into a separate security domain.\nC:H - charge_preallocation_work on afs_wq dereferences freed struct afs_net fields (socket, spare_incoming_call, nr_outstanding_calls) after per-net exit; UAF of slab objects enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Continued charging and afs_alloc_call through freed afs_net writes into stale per-net counters and socket state; UAF supports heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - Use-after-free on afs_net and its RxRPC socket during teardown causes kernel oops or panic; even without full exploitation the race reliably crashes the host and can be retriggered on demand."
    }
  }
}