CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger
A race condition in Linux kernel AFS network namespace teardown can cause a denial of service by failing to cancel preallocation work items.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74427?
CVE-2026-74427 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix netns teardown to cancel the preallocation charger
Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls are disabled (i.e. listen 0).
Also, if net->live is false because the afs netns is being deleted, make afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid requeuing the charger.
(This was found by AI review).
Which versions are affected by CVE-2026-74427?
How do I fix CVE-2026-74427?
Apply the vendor's patch.
Is CVE-2026-74427 being exploited?
There is no known exploitation of CVE-2026-74427 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74427, DEBIAN-CVE-2026-74427, GHSA-2hj8-22xr-w775, UBUNTU-CVE-2026-74427.