---
id: CVE-2026-74427
title: 'afs: Fix netns teardown to cancel the preallocation charger'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  afs: Fix netns teardown to cancel the preallocation charger

  Fix the teardown of an afs network namespace to make sure it cancels the
  work item that keeps the prealloca…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    85d5fb80fe4f0cc836b6df83f26de204fe102ff7
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    a33975ff2b6ea47b8f29956403374b1cdd057539
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    b83ecf80e28afb7b6595ba79932e77ca68a5a83d
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    eec89c5f8e1adc1de4824042ef75f62aed804153
  - >-
    Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 <
    47694fbc9d24ab6bf210f91e8efe06a10a478064
  - Linux 4.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:19.118841Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:44.869Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74427'
references:
  - url: 'https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9'
  - url: 'https://git.kernel.org/stable/c/f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1'
  - url: 'https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a'
  - url: 'https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7'
  - url: 'https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539'
  - url: 'https://git.kernel.org/stable/c/b83ecf80e28afb7b6595ba79932e77ca68a5a83d'
  - url: 'https://git.kernel.org/stable/c/eec89c5f8e1adc1de4824042ef75f62aed804153'
  - url: 'https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064'
tags:
  - cve.org
epss: 0.00755
epssPercentile: 0.54209
ingestedAt: '2026-10-16T19:46:24.363Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix netns teardown to cancel the preallocation charger

Fix the teardown of an afs network namespace to make sure it cancels the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before incoming calls are disabled (i.e. listen 0).

Also, if net->live is false because the afs netns is being deleted, make
afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid
requeuing the charger.

(This was found by AI review).

## Affected

- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < f5096e18b6b7fbd1c2a1942e275a51bcfdfb2ad1`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 85d5fb80fe4f0cc836b6df83f26de204fe102ff7`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < a33975ff2b6ea47b8f29956403374b1cdd057539`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < b83ecf80e28afb7b6595ba79932e77ca68a5a83d`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < eec89c5f8e1adc1de4824042ef75f62aed804153`
- `Linux >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 47694fbc9d24ab6bf210f91e8efe06a10a478064`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.