CVE-2026-74506

A flaw was found in the Linux kernel's AFS (Andrew File System) component. A race condition exists in the afs_make_call() function during asynchronous call reception and destruction when sending a message. This can lead to a Use-After-Free (UAF) vulnerability, where memory is improperly accessed after it has been deallocated. A local attacker could potentially exploit this to cause memory corruption, leading to a denial of service or other unpredictable system behavior.

A use-after-free race in the AFS client can occur when afs_make_call() continues to access an asynchronous afs_call after rxrpc completion or abort handling has already dropped the last reference. A local user can trigger the vulnerable path by performing AFS IO on a mounted AFS filesystem, while a malicious or compromised AFS server may influence timing by completing or aborting the request after the client initiated operation. For the CVSS the PR:L is used because reliable triggering normally requires a local user or process with access to the AFS mount, not full administrative privileges. The issue is not directly network reachable as an unsolicited server side attack against a listening service. Impact is at least a local denial of service via kernel crash and in worst case may allow privilege escalation due to kernel use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.