CVE-2026-74427

CVE-2026-74427 is a race condition in AFS network namespace teardown where the charger work item wasn't cancelled before calls were disabled, allowing it to race against namespace death and potentially trigger a use-after-free. The charger is a performance optimization—preallocated rxrpc calls to reduce allocation latency under load—but that optimization created a teardown hazard that only manifests during namespace destruction, a code path exercised rarely and hard to test. The fix adds a guard checking net->live before charging, alongside the missing cancel call. This is defense-in-depth, but it also exposes the real problem: the original charger design had no concept of 'namespace lifecycle phase'. There's no formal state machine telling work items when they're no longer valid to run. The dependency exists only in developers' heads—that charger must die before listen(0) because it might queue work into a half-dead network stack. The CVSS 9.8 reflects the blast radius: the charger holds references to rxrpc calls, connections, and peer objects that can survive namespace teardown, creating a potential pivot point across the network namespace boundary. But the more important signal is structural: this is the same class of bug that netfilter and netns core hardened against in 2013-2015. AFS is having its '2013 moment' now, discovered late because filesystem network namespaces are a narrower attack surface than core networking. What you should do: audit your kernel's network namespace consumers for similar charger-or-equivalent work-item patterns that lack lifecycle-aware teardown. The existence of net->live as a flag proves the infrastructure for lifecycle tracking exists—but it wasn't applied consistently. If you maintain any kernel subsystem that creates network namespaces and queues async work, check whether that work is cancelled before namespace destruction, not just whether it checks 'am I alive'. The AI reviewer found this one because these races are cognitively invisible during normal code review—human reviewers project from init paths where the mental model is solid. Assume there are more.

Reviewed through automated stages and approved by a human before publication.