{"apiVersion":"1.0","identifier":"CVE-2026-74506","description":"In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there-s a race with async call reception and destruction. If a call is dispatched that doesn-t have call->write_iter set (used to specify the data content for FS.StoreData), then the first rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr. Once rxrpc_send_data() queues the last request packet, the response could come in at any time and cause the call to be completed and put. However, afs_make_call() will look at the call again to see it ->write_iter should be handled - something it-s only allowed to do if it has its own ref on the call. Whilst this is the case for synchronous calls, it isn-t true for async calls such as FS.FetchData. There-s also a potential UAF in afs_make_call() in the event that an asynchronous call is being sent, but the call fails in some way (e.g. it gets aborted from the server). The problem there is that afs_make_call() tries to abort a call if the rxrpc send fails, but the asynchronous notification from rxrpc may have caused the afs_call to be torn down. generic/650 plays games with randomly taking CPUs offline, and can interject a significant delay such that the call is deallocated before afs_make_call() gets to check call->write_iter - and a UAF ensues (caught by KASAN). BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs] Read of size 8 at addr ffff888035e050e8 by task fsstress/1409 Fix this by making afs_make_op_call() give the op->call its own ref rather than transferring the caller-s ref to it and then dropping the ref when afs_make_call() returns. This also means that the afs_make_call() func never loses its ref on the call now.","publishedAt":"2026-08-15T13:17:55","lastModifiedAt":"2026-08-17T06:19:47","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74506","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00124,"riskScore":0.79,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74506","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74506","en":"https://www.redsauce.net/en/cves/CVE-2026-74506","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74506","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74506","de":"https://www.redsauce.net/de/cves/CVE-2026-74506","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74506","el":"https://www.redsauce.net/el/cves/CVE-2026-74506"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74506"}}