A flaw in the Linux kernel's rxrpc module causes the recvmsg() handler to unconditionally requeue a request when called with the MSG_DONTWAIT flag while the queue's front mutex is already held. This logic can corrupt the receive‑message queue, resulting in use‑after‑free or reference‑count underrun bugs that an attacker may exploit to execute arbitrary instructions in kernel context.

Linux kernel versions 6.19 release candidates rc1 through rc6 are affected. Any system running those release candidates is vulnerable; no other vendor kernels are listed as impacted.

The CVSS score of 7.8 classifies the vulnerability as high severity, but the EPSS score of less than 1% indicates a very low current exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation would require an attacker to open an rxrpc socket with MSG_DONTWAIT (and possibly MSG_PEEK), triggering the erroneous requeue logic, potentially leading to kernel memory corruption and privilege escalation to root, although real‑world exploitation appears limited at present.