CVE-2026-74426

Received Received - Intake

NULL Pointer Dereference in Linux Kernel AFS

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs_get_tree() afs_alloc_sbi() uses kzalloc for memory allocation. And, if ctx->dyn_root is not null, as->cell and as->volume are null. In trace_afs_get_tree() they are dereferenced. KASAN error message: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550 include/trace/events/afs.h:1365 Call Trace: trace_afs_get_tree include/trace/events/afs.h:1365 [inline] afs_get_tree+0x922/0x1350 fs/afs/super.c:599 vfs_get_tree+0x8e/0x300 fs/super.c:1572 do_new_mount fs/namespace.c:3011 [inline] path_mount+0x14a5/0x2220 fs/namespace.c:3341 do_mount fs/namespace.c:3354 [inline] __do_sys_mount fs/namespace.c:3562 [inline] __se_sys_mount fs/namespace.c:3539 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3539 do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74426

EUVD

EUVD-2026-59573

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.10.246 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's AFS (Andrew File System) module. It occurs when afs_alloc_sbi() allocates memory with kzalloc, but certain fields (as->cell and as->volume) are left null while ctx->dyn_root is not null. When trace_afs_get_tree() tries to access these null fields, it causes a kernel crash due to dereferencing a null pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's AFS (Andrew File System) component and involves a NULL pointer dereference in afs_get_tree(). Detection requires checking for kernel logs indicating a NULL pointer dereference in AFS-related functions, particularly during mount operations. Look for KASAN errors or kernel oops messages related to afs_get_tree or trace_afs_get_tree.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when mounting an AFS filesystem, leading to denial of service. An attacker with local access could exploit this to crash the system. It does not allow arbitrary code execution or data theft directly.

Compliance Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's AFS (Andrew File System) component. It does not directly relate to data privacy, access controls, or audit logging requirements typically addressed by GDPR or HIPAA. The issue could lead to system crashes or denial-of-service conditions, which may indirectly impact availability of systems processing regulated data.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution to resolve the NULL pointer dereference in AFS. If immediate patching is not possible, consider disabling the AFS module (afs) if it is not required on your system. Monitor kernel logs for signs of exploitation or crashes related to AFS operations.

Hi! I’m here to help you understand CVE-2026-74426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70