---
id: CVE-2026-74427
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  afs: Fix netns teardown to cancel the preallocation charger

  Fix the teardown of an afs network namespace to make sure it cancels the
  work item that keeps the prealloca…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  afs: Fix netns teardown to cancel the preallocation charger

  Fix the teardown of an afs network namespace to make sure it cancels the
  work item that keeps the prealloca…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    85d5fb80fe4f0cc836b6df83f26de204fe102ff7
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    a33975ff2b6ea47b8f29956403374b1cdd057539
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    b83ecf80e28afb7b6595ba79932e77ca68a5a83d
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    eec89c5f8e1adc1de4824042ef75f62aed804153
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    47694fbc9d24ab6bf210f91e8efe06a10a478064
  - Linux 4.9
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:27.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74427'
references:
  - url: 'https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00755
epssPercentile: 0.54916
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:19.118841Z'
ingestedAt: '2026-10-16T19:46:24.363Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix netns teardown to cancel the preallocation charger

Fix the teardown of an afs network namespace to make sure it cancels the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before incoming calls are disabled (i.e. listen 0).

Also, if net->live is false because the afs netns is being deleted, make
afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid
requeuing the charger.

(This was found by AI review).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.