CVE-2026-74426 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
afs: fix NULL pointer dereference in afs_get_tree()
afs_alloc_sbi() uses kzalloc for memory allocation. And, if ctx->dyn_root is not null, as->cell and as->volume are null. In trace_afs_get_tree() they are dereferenced.
KASAN error message:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550 include/trace/events/afs.h:1365
Call Trace: trace_afs_get_tree include/trace/events/afs.h:1365 [inline]
afs_get_tree+0x922/0x1350 fs/afs/super.c:599 vfs_get_tree+0x8e/0x300 fs/super.c:1572 do_new_mount fs/namespace.c:3011 [inline]
path_mount+0x14a5/0x2220 fs/namespace.c:3341 do_mount fs/namespace.c:3354 [inline]
__do_sys_mount fs/namespace.c:3562 [inline]
__se_sys_mount fs/namespace.c:3539 [inline]
__x64_sys_mount+0x283/0x300 fs/namespace.c:3539 do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the AFS (Andrew File System) implementation in the Linux kernel, specifically in the afs_get_tree() function where a NULL pointer dereference occurs. This flaw represents a classic null pointer dereference issue that can lead to system instability and potential privilege escalation. The problem manifests when the afs_alloc_sbi() function allocates memory using kzalloc but fails to properly initialize all structure members before subsequent operations attempt to access them. When ctx->dyn_root is not null, the as->cell and as->volume pointers remain uninitialized, creating a scenario where trace_afs_get_tree() attempts to dereference these NULL pointers during kernel tracing operations.
The technical execution of this vulnerability occurs through the kernel's AFS superblock initialization process where memory allocation precedes proper structure initialization. The kzalloc function in afs_alloc_sbi() allocates zeroed memory but does not guarantee that all pointer fields within the allocated structure are properly set to valid addresses. When the system attempts to trace the afs_get_tree operation, the trace function accesses as->cell and as->volume pointers which remain NULL due to incomplete initialization. This creates a KASAN (Kernel Address Sanitizer) null pointer dereference error that manifests with the specific error message indicating the fault occurred in perf_trace_afs_get_tree at offset 0x1d9 within the include/trace/events/afs.h file.
This vulnerability has significant operational impact as it can cause kernel panics or system crashes when AFS filesystem operations are performed, particularly during mount operations. The exploitation path involves triggering an AFS mount operation that causes the kernel to execute the faulty trace code path, leading to immediate system instability. From a security perspective, while this vulnerability may not directly enable privilege escalation, it can be leveraged as part of a broader attack chain to cause denial of service or potentially facilitate more sophisticated attacks. The issue affects systems running Linux kernel versions that include the affected AFS implementation and is particularly concerning in environments where AFS filesystems are actively used.
The mitigation strategy involves implementing proper initialization checks within the afs_alloc_sbi() function to ensure that all structure members are properly initialized before being accessed by subsequent trace operations. Kernel developers should add validation logic to verify that ctx->dyn_root is properly handled and that as->cell and as->volume pointers are either properly initialized or appropriately guarded against NULL dereference attempts. Additionally, the trace infrastructure should be enhanced with proper null checks before accessing potentially uninitialized pointers. This vulnerability aligns with CWE-476 which describes NULL Pointer Dereference, and could be categorized under ATT&CK technique T1059.006 for kernel-level command execution or T1489 for system network configuration modification if exploited in specific contexts.
The discovery of this vulnerability through the Linux Verification Center using Syzkaller demonstrates the effectiveness of automated fuzzing tools in identifying kernel-level memory safety issues. The specific call trace shows the execution path from vfs_get_tree down to the problematic afs_get_tree function, with the error originating in the trace event processing rather than the main filesystem logic itself. This highlights the importance of proper initialization sequences in kernel code and suggests that similar patterns may exist elsewhere in the kernel's filesystem subsystem where trace events access structure members without proper validation checks. The vulnerability represents a fundamental flaw in defensive programming practices within the AFS implementation, emphasizing the need for comprehensive initialization verification throughout kernel subsystems to prevent such null pointer dereference scenarios from occurring in production environments.