{"cve":"CVE-2026-74427","nvd":{"published":"2026-08-15T06:22:44.810","modified":"2026-10-16T20:17:27.317","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix netns teardown to cancel the preallocation charger\n\nFix the teardown of an afs network namespace to make sure it cancels the\nwork item that keeps the preallocated rxrpc call/conn/peer queue charged\nbefore incoming calls are disabled (i.e. listen 0).\n\nAlso, if net->live is false because the afs netns is being deleted, make\nafs_charge_preallocation() skip charging and make afs_rx_new_call() avoid\nrequeuing the charger.\n\n(This was found by AI review).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/47694fbc9d24ab6bf210f91e8efe06a10a478064","https://git.kernel.org/stable/c/59e8b7652f6cbfb62d377ead0ad553c1b4e39a7a","https://git.kernel.org/stable/c/63ccaf1bdf8be2330f47f9b5b233dd3fd04acbd9","https://git.kernel.org/stable/c/85d5fb80fe4f0cc836b6df83f26de204fe102ff7","https://git.kernel.org/stable/c/a33975ff2b6ea47b8f29956403374b1cdd057539"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74427","score":0.00755,"percentile":0.54836,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}