CVE-2026-74506

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the AFS component of the Linux kernel. The problem occurs in the afs make call() function due to a race condition between asynchronous call reception and destruction. When an asynchronous call, such as FS.FetchData, is dispatched without the write iter variable set, the system may complete and deallocate the call before afs make call() can verify if write iter needs handling. Additionally, a UAF can occur if an asynchronous call fails or is aborted by the server, as the afs make call() function may attempt to abort a call that has already been torn down by an asynchronous notification from rxrpc. Use-After-Free is a condition where a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.