CVE-2026-74435: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-15 · updated 2026-08-17

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.

Affected products

Linux kernel: from 6.6.143 before 6.6.145; from 6.12.93 before 6.12.97; from 6.18.35 before 6.18.40; from 7.0.11 before 7.1; 7.1 — fixed in 6.12.97, 6.18.40, 6.6.145, 7.1, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.12.97, 6.18.40, 6.6.145, 7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74435 or the next vulnerability affects your stack