CVE-2026-74435rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a05bf6d9e621fa71e89ccebe3047ba45218d7b38 before 8bbede0afced346b24e4fbde0c68cf12980ba948; from b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5 before 6563b4eb38c35d75892445bcf8aacdc29914821c; from 46cb765e2e5ad52303ea157e10d370bb6b7acbbf before d3b642cf95d48234590cc91450d8705a9bf6b540; from d2bc90cf6c75cb96d2ce549be6c35efa3099d25b before a962bc8508592c4d51092edac68579bd8b18fe44; from d2bc90cf6c75cb96d2ce549be6c35efa3099d25b before 16c8ae9735c5bd7e54dd7478d6348e0fc860842d; c580087743712112778a06d65a4074053072d7bf; from 6.6.143 before 6.6.145; from 6.12.93 before 6.12.97; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8bbede0afced346b24e4fbde0c68cf12980ba948
- https://git.kernel.org/stable/c/6563b4eb38c35d75892445bcf8aacdc29914821c
- https://git.kernel.org/stable/c/d3b642cf95d48234590cc91450d8705a9bf6b540
- https://git.kernel.org/stable/c/a962bc8508592c4d51092edac68579bd8b18fe44
- https://git.kernel.org/stable/c/16c8ae9735c5bd7e54dd7478d6348e0fc860842d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.