CVE-2026-74426 (GCVE-0-2026-74426)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-08-17 05:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
afs: fix NULL pointer dereference in afs_get_tree()
afs_alloc_sbi() uses kzalloc for memory allocation. And, if
ctx->dyn_root is not null, as->cell and as->volume are null.
In trace_afs_get_tree() they are dereferenced.
KASAN error message:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
04/01/2014
RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550
include/trace/events/afs.h:1365
Call Trace:
trace_afs_get_tree include/trace/events/afs.h:1365 [inline]
afs_get_tree+0x922/0x1350 fs/afs/super.c:599
vfs_get_tree+0x8e/0x300 fs/super.c:1572
do_new_mount fs/namespace.c:3011 [inline]
path_mount+0x14a5/0x2220 fs/namespace.c:3341
do_mount fs/namespace.c:3354 [inline]
__do_sys_mount fs/namespace.c:3562 [inline]
__se_sys_mount fs/namespace.c:3539 [inline]
__x64_sys_mount+0x283/0x300 fs/namespace.c:3539
do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 Version: 80548b03991f58758a336424a90bf9f988e3b077 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/afs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "67fb48c4a0874953212321cd5d57fdb4900dbc31",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "d648cc2069eb081707c061849046d909f57c78b1",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "d5b17474feed3c30991f07affa2473adbad95055",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "867b3ea146a041023bfcd258e6db516b1bb28f19",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "ea19edf71721cd42f923e3c70f4ff995b422fe3b",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "23b3d457d8387bcb2a61063a9e520063ada9335f",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "70b2842734d831c908474779bb8a76daf55f782c",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
},
{
"lessThan": "0b70716081c6462be9b2928ad736d0d527b09678",
"status": "affected",
"version": "80548b03991f58758a336424a90bf9f988e3b077",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/afs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: fix NULL pointer dereference in afs_get_tree()\n\nafs_alloc_sbi() uses kzalloc for memory allocation. And, if\nctx-\u003edyn_root is not null, as-\u003ecell and as-\u003evolume are null.\nIn trace_afs_get_tree() they are dereferenced.\n\nKASAN error message:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1\n04/01/2014\nRIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550\ninclude/trace/events/afs.h:1365\n\nCall Trace:\ntrace_afs_get_tree include/trace/events/afs.h:1365 [inline]\nafs_get_tree+0x922/0x1350 fs/afs/super.c:599\nvfs_get_tree+0x8e/0x300 fs/super.c:1572\ndo_new_mount fs/namespace.c:3011 [inline]\npath_mount+0x14a5/0x2220 fs/namespace.c:3341\ndo_mount fs/namespace.c:3354 [inline]\n__do_sys_mount fs/namespace.c:3562 [inline]\n__se_sys_mount fs/namespace.c:3539 [inline]\n__x64_sys_mount+0x283/0x300 fs/namespace.c:3539\n do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46\nentry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:19:11.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/67fb48c4a0874953212321cd5d57fdb4900dbc31"
},
{
"url": "https://git.kernel.org/stable/c/d648cc2069eb081707c061849046d909f57c78b1"
},
{
"url": "https://git.kernel.org/stable/c/d5b17474feed3c30991f07affa2473adbad95055"
},
{
"url": "https://git.kernel.org/stable/c/867b3ea146a041023bfcd258e6db516b1bb28f19"
},
{
"url": "https://git.kernel.org/stable/c/ea19edf71721cd42f923e3c70f4ff995b422fe3b"
},
{
"url": "https://git.kernel.org/stable/c/23b3d457d8387bcb2a61063a9e520063ada9335f"
},
{
"url": "https://git.kernel.org/stable/c/70b2842734d831c908474779bb8a76daf55f782c"
},
{
"url": "https://git.kernel.org/stable/c/0b70716081c6462be9b2928ad736d0d527b09678"
}
],
"title": "afs: fix NULL pointer dereference in afs_get_tree()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74426",
"datePublished": "2026-08-15T05:59:28.427Z",
"dateReserved": "2026-08-15T05:44:03.894Z",
"dateUpdated": "2026-08-17T05:19:11.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…