CVE-2026-74435 (GCVE-0-2026-74435)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-08-17 05:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.
In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.
To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.
This issue was identified with assistance of a private
sashiko instance.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a05bf6d9e621fa71e89ccebe3047ba45218d7b38 Version: b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5 Version: 46cb765e2e5ad52303ea157e10d370bb6b7acbbf Version: d2bc90cf6c75cb96d2ce549be6c35efa3099d25b Version: d2bc90cf6c75cb96d2ce549be6c35efa3099d25b Version: c580087743712112778a06d65a4074053072d7bf Version: 6.6.143 ≤ Version: 6.12.93 ≤ Version: 6.18.35 ≤ Version: 7.0.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rxrpc/recvmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bbede0afced346b24e4fbde0c68cf12980ba948",
"status": "affected",
"version": "a05bf6d9e621fa71e89ccebe3047ba45218d7b38",
"versionType": "git"
},
{
"lessThan": "6563b4eb38c35d75892445bcf8aacdc29914821c",
"status": "affected",
"version": "b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5",
"versionType": "git"
},
{
"lessThan": "d3b642cf95d48234590cc91450d8705a9bf6b540",
"status": "affected",
"version": "46cb765e2e5ad52303ea157e10d370bb6b7acbbf",
"versionType": "git"
},
{
"lessThan": "a962bc8508592c4d51092edac68579bd8b18fe44",
"status": "affected",
"version": "d2bc90cf6c75cb96d2ce549be6c35efa3099d25b",
"versionType": "git"
},
{
"lessThan": "16c8ae9735c5bd7e54dd7478d6348e0fc860842d",
"status": "affected",
"version": "d2bc90cf6c75cb96d2ce549be6c35efa3099d25b",
"versionType": "git"
},
{
"status": "affected",
"version": "c580087743712112778a06d65a4074053072d7bf",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThan": "6.18.40",
"status": "affected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rxrpc/recvmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.18.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc\n\nrxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the\nrxrpc_call.rx_dec_buffer is unallocated and assumes that upon\nsuccessful return that rx_dec_buffer must be allocated.\nHowever, rxrpc_verify_data() does not request an allocation if\nthe rxrpc_skb_priv.len is zero.\n\nIn addition, failure to allocate rx_dec_buffer will result in a\ncall to skb_copy_bits() with a NULL destination which can\ntrigger a NULL pointer dereference.\n\nTo prevent these issues rxrpc_verify_data() is modified to\nalways attempt to allocate the rxrpc_call.rx_dec_buffer if it\nis NULL.\n\nThis issue was identified with assistance of a private\nsashiko instance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - RxRPC runs over UDP/IP; a remote peer can deliver crafted DATA packets that are queued on the receive path and later processed in rxrpc_verify_data() via recvmsg/kernel_recv_data, with no local access required.\nAC:L - An attacker can reliably trigger the bug by sending a zero-length RxRPC DATA packet (header-only skb so sp-\u003elen==0) to a listening service; no races or victim-specific state are needed beyond an active RxRPC/AFS endpoint.\nPR:N - Incoming DATA packets are accepted and queued on new calls before Kerberos authentication completes, so an unauthenticated remote attacker can reach the vulnerable recvmsg path on internet-facing AFS/RxRPC servers without any local privileges.\nUI:N - On AFS/RxRPC servers the kernel automatically receives network DATA, queues it, and invokes rxrpc_kernel_recv_data through service callbacks; exploitation requires no victim user action such as mounting a filesystem or opening a file.\nS:U - The flaw causes a kernel NULL pointer dereference during in-kernel packet processing on the same host running the RxRPC/AFS service; it does not cross a VM, container, or IOMMU security boundary.\nC:N - The failure mode is a NULL pointer dereference in skb_copy_bits()/subsequent recvmsg handling when rx_dec_buffer was never allocated; this is a pure crash path with no demonstrated or plausible arbitrary kernel memory read or information disclosure.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug dereferences a NULL decryption buffer during receive processing and results in kernel oops/panic rather than controlled data modification.\nA:H - A successful trigger causes a kernel NULL pointer dereference during recvmsg data verification/decryption, which can oops or panic the host and deny service to all workloads on affected AFS/RxRPC servers until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:47:09.898Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bbede0afced346b24e4fbde0c68cf12980ba948"
},
{
"url": "https://git.kernel.org/stable/c/6563b4eb38c35d75892445bcf8aacdc29914821c"
},
{
"url": "https://git.kernel.org/stable/c/d3b642cf95d48234590cc91450d8705a9bf6b540"
},
{
"url": "https://git.kernel.org/stable/c/a962bc8508592c4d51092edac68579bd8b18fe44"
},
{
"url": "https://git.kernel.org/stable/c/16c8ae9735c5bd7e54dd7478d6348e0fc860842d"
}
],
"title": "rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74435",
"datePublished": "2026-08-15T05:59:34.073Z",
"dateReserved": "2026-08-15T05:44:03.896Z",
"dateUpdated": "2026-08-17T05:47:09.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…