CVE-2026-74426

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74426", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.894Z", "datePublished": "2026-08-15T05:59:28.427Z", "dateUpdated": "2026-08-17T05:19:11.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:19:11.836Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: fix NULL pointer dereference in afs_get_tree()\n\nafs_alloc_sbi() uses kzalloc for memory allocation. And, if\nctx->dyn_root is not null, as->cell and as->volume are null.\nIn trace_afs_get_tree() they are dereferenced.\n\nKASAN error message:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1\n04/01/2014\nRIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550\ninclude/trace/events/afs.h:1365\n\nCall Trace:\ntrace_afs_get_tree include/trace/events/afs.h:1365 [inline]\nafs_get_tree+0x922/0x1350 fs/afs/super.c:599\nvfs_get_tree+0x8e/0x300 fs/super.c:1572\ndo_new_mount fs/namespace.c:3011 [inline]\npath_mount+0x14a5/0x2220 fs/namespace.c:3341\ndo_mount fs/namespace.c:3354 [inline]\n__do_sys_mount fs/namespace.c:3562 [inline]\n__se_sys_mount fs/namespace.c:3539 [inline]\n__x64_sys_mount+0x283/0x300 fs/namespace.c:3539\n do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46\nentry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/super.c"], "versions": [{"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "67fb48c4a0874953212321cd5d57fdb4900dbc31", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "d648cc2069eb081707c061849046d909f57c78b1", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "d5b17474feed3c30991f07affa2473adbad95055", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "867b3ea146a041023bfcd258e6db516b1bb28f19", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "ea19edf71721cd42f923e3c70f4ff995b422fe3b", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "23b3d457d8387bcb2a61063a9e520063ada9335f", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "70b2842734d831c908474779bb8a76daf55f782c", "status": "affected", "versionType": "git"}, {"version": "80548b03991f58758a336424a90bf9f988e3b077", "lessThan": "0b70716081c6462be9b2928ad736d0d527b09678", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/afs/super.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/67fb48c4a0874953212321cd5d57fdb4900dbc31"}, {"url": "https://git.kernel.org/stable/c/d648cc2069eb081707c061849046d909f57c78b1"}, {"url": "https://git.kernel.org/stable/c/d5b17474feed3c30991f07affa2473adbad95055"}, {"url": "https://git.kernel.org/stable/c/867b3ea146a041023bfcd258e6db516b1bb28f19"}, {"url": "https://git.kernel.org/stable/c/ea19edf71721cd42f923e3c70f4ff995b422fe3b"}, {"url": "https://git.kernel.org/stable/c/23b3d457d8387bcb2a61063a9e520063ada9335f"}, {"url": "https://git.kernel.org/stable/c/70b2842734d831c908474779bb8a76daf55f782c"}, {"url": "https://git.kernel.org/stable/c/0b70716081c6462be9b2928ad736d0d527b09678"}], "title": "afs: fix NULL pointer dereference in afs_get_tree()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/afs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "67fb48c4a0874953212321cd5d57fdb4900dbc31", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "d648cc2069eb081707c061849046d909f57c78b1", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "d5b17474feed3c30991f07affa2473adbad95055", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "867b3ea146a041023bfcd258e6db516b1bb28f19", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "ea19edf71721cd42f923e3c70f4ff995b422fe3b", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "23b3d457d8387bcb2a61063a9e520063ada9335f", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "70b2842734d831c908474779bb8a76daf55f782c", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}, {"lessThan": "0b70716081c6462be9b2928ad736d0d527b09678", "status": "affected", "version": "80548b03991f58758a336424a90bf9f988e3b077", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/afs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: fix NULL pointer dereference in afs_get_tree()\n\nafs_alloc_sbi() uses kzalloc for memory allocation. And, if\nctx->dyn_root is not null, as->cell and as->volume are null.\nIn trace_afs_get_tree() they are dereferenced.\n\nKASAN error message:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1\n04/01/2014\nRIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550\ninclude/trace/events/afs.h:1365\n\nCall Trace:\ntrace_afs_get_tree include/trace/events/afs.h:1365 [inline]\nafs_get_tree+0x922/0x1350 fs/afs/super.c:599\nvfs_get_tree+0x8e/0x300 fs/super.c:1572\ndo_new_mount fs/namespace.c:3011 [inline]\npath_mount+0x14a5/0x2220 fs/namespace.c:3341\ndo_mount fs/namespace.c:3354 [inline]\n__do_sys_mount fs/namespace.c:3562 [inline]\n__se_sys_mount fs/namespace.c:3539 [inline]\n__x64_sys_mount+0x283/0x300 fs/namespace.c:3539\n do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46\nentry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."}], "id": "CVE-2026-74426", "lastModified": "2026-08-17T06:19:38.110", "metrics": {}, "published": "2026-08-15T06:22:44.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b70716081c6462be9b2928ad736d0d527b09678"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23b3d457d8387bcb2a61063a9e520063ada9335f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67fb48c4a0874953212321cd5d57fdb4900dbc31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70b2842734d831c908474779bb8a76daf55f782c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/867b3ea146a041023bfcd258e6db516b1bb28f19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5b17474feed3c30991f07affa2473adbad95055"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d648cc2069eb081707c061849046d909f57c78b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea19edf71721cd42f923e3c70f4ff995b422fe3b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: afs: fix NULL pointer dereference in afs_get_tree()", "id": "2516811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516811"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's AFS (Andrew File System) component. A local user can exploit this by triggering a specific memory allocation condition during a mount operation, leading to a null pointer dereference. This can cause the system to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-74426", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74426\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74426\nhttps://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-74426-3f85@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,67fb48c4a0874953212321cd5d57fdb4900dbc31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,d648cc2069eb081707c061849046d909f57c78b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,d5b17474feed3c30991f07affa2473adbad95055)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,867b3ea146a041023bfcd258e6db516b1bb28f19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,ea19edf71721cd42f923e3c70f4ff995b422fe3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,23b3d457d8387bcb2a61063a9e520063ada9335f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,70b2842734d831c908474779bb8a76daf55f782c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80548b03991f58758a336424a90bf9f988e3b077,0b70716081c6462be9b2928ad736d0d527b09678)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.261,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.212,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.178,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.145,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.97,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.40,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:00:08.919979+00:00", "updated": "2026-08-21T22:15:04.724711+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}