CVE-2026-74506 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users who may be affected by this vulnerability, particularly those responsible for managing and securing Linux-based systems, should prioritize patching the Linux kernel to prevent exploitation. Additionally, Linux distribution maintainers, security teams, and operators who oversee Linux infrastructure should be aware of this vulnerability and take necessary precautions.

Why it matters

This vulnerability is significant because it can lead to a use-after-free error in the Linux kernel's afs implementation, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

• Defenders should prioritize patching the Linux kernel to prevent exploitation of this vulnerability.
• Verify that the Linux kernel is updated to a version that includes the fix to ensure that the use-after-free vulnerability is not present.
• Monitor the Linux kernel for any future updates or patches related to this vulnerability to ensure that any potential issues are addressed.

Technical summary

The vulnerability exists in the `afs_make_call()` function, which is used to send messages in the afs file system. The issue arises from a race condition between asynchronous call reception and destruction. If a call is dispatched without setting `call->write_iter`, the first `rxrpc_kernel_send_data()` will not set `MSG_MORE` in the msghdr. This can cause the call to be completed and put, but then later accessed, resulting in a use-after-free error.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel to fix the use-after-free vulnerability.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor the Linux kernel for any future updates or patches related to this vulnerability.
• Perform a thorough review of the system to identify any potential exposure.
• Verify that the Linux kernel is updated to a version that includes the fix to ensure that the use-after-free vulnerability is not present.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by a race condition in the `afs_make_call()` function, which can lead to a use-after-free error. The issue is exacerbated by the fact that asynchronous calls may be torn down, causing the afs_call to be destroyed. However, the `afs_make_call()` function may still attempt to access the call, resulting in a use-after-free error.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.