CVE-2026-74506 evidence review
Linux
In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there's a race with async call reception and destruction. If a call is dispatched that doesn't have call->write_iter set (used to specify the data content for FS.StoreData), then the first rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr. Once rxrpc_send_data() queues the last request packet, the response could come in at any time and cause the call to be completed and put. However, afs_make_call() will look at the call again to see it ->write_iter should b...
This record remains available for product and version identification, but it is not presented as a complete remediation procedure. Confirm the affected range and the supported fix in a direct vendor advisory before changing production systems.
Identify the product and installed version
Record whether Linux is present, where it is installed, and which interfaces are exposed.
- Record the product name, package or appliance identifier, and installed version.
- Identify internet-facing, administrative, API, and internal access paths.
- Preserve the pre-change configuration and relevant service logs.
Compare the affected range
Use the current record as an identification aid: >= e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2 < c0d3b81f703b2a9e37fe1347610a50cdf0078c27, >= e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2 < daaa726b14fc3026a6b328614d312b698f62f391, >= e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2 < 4af1ec68d54b3871155914d584fb10669c41a861, >= 5.8. Resolve incomplete inventory results before deciding that an asset is unaffected.
Verify the authoritative remediation source
Open the linked source material and locate a direct vendor advisory for this CVE. Confirm the supported fixed release and product-specific update path before making a production change.
Operational boundary
This page does not replace the vendor advisory, support contract, change-management process, or recovery plan. Do not infer that an asset is unaffected from an incomplete inventory query or a missing fixed-version field.