CVE-2026-74425

A flaw was found in the Linux kernel's AFS (Andrew File System) cache manager. The CB.InitCallBackState3 handler did not properly verify the presence of an associated server record for incoming callback requests. This could lead to unexpected system behavior or instability if a request was processed without the necessary peer state.

Red Hat has evaluated this issue as having a Moderate security impact because exploitation requires that the in-kernel Andrew File System (AFS) client module is actively in use, limiting exposure primarily to systems configured with AFS mounts. On default installations, the AFS filesystem driver is not automatically loaded or utilized. While an unmapped callback request could trigger unexpected kernel instability or a denial of service, the risk is confined to system availability without compromising confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.