A flaw in the Linux kernel's rxrpc implementation causes the recvmsg() routine to requeue a request unconditionally when the MSG_DONTWAIT flag is specified and the mutex for the front of the queue is already locked. This logic can corrupt the recvmsg queue, resulting in use‑after‑free or reference‑count underrun bugs that an attacker could exploit to execute arbitrary code in kernel context. Based on the description, it is inferred that an attacker might potentially exploit this vulnerability to execute arbitrary code in kernel context. The vulnerability arises when the queue contains a request from a previous MSG_PEEK operation or an I/O thread that has already requeued it, and the function proceeds to requeue it again regardless of its current state.

Linux kernel versions 6.19 rc1 through rc6 are affected; any system running these release candidates would be vulnerable. No other vendor or commercial kernel versions are listed as impacted.

The CVSS score of 7.8 classifies this as a High‑severity flaw, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker would need to run a program that opens an rxrpc socket with MSG_DONTWAIT and possibly MSG_PEEK to trigger the requeue logic. Based on the description, it is inferred that if exploited, the impact could be system‑wide compromise.