CVE-2026-23066

rxrpc: Fix recvmsg() unconditional requeue

Published Feb 4, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix recvmsg() unconditional requeue

If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at
the front of the recvmsg queue already has its mutex locked, it requeues
the call - whether or not the call is already queued. The call may be on
the queue because MSG_PEEK was also passed and so the call was not dequeued
or because the I/O thread requeued it.

The unconditional requeue may then corrupt the recvmsg queue, leading to
things like UAFs or refcount underruns.

Fix this by only requeuing the call if it isn't already on the queue - and
moving it to the front if it is already queued. If we don't queue it, we
have to put the ref we obtained by dequeuing it.

Also, MSG_PEEK doesn't dequeue the call so shouldn't call
rxrpc_notify_socket() for the call if we didn't use up all the data on the
queue, so fix that also.

Analysis

Technical impact

A flaw in the Linux kernel's rxrpc module causes the recvmsg() handler to unconditionally requeue a request when called with the MSG_DONTWAIT flag while the queue's front mutex is already held. This logic can corrupt the receive‑message queue, resulting in use‑after‑free or reference‑count underrun bugs that an attacker may exploit to execute arbitrary instructions in kernel context.

Affected Systems

Linux kernel versions 6.19 release candidates rc1 through rc6 are affected. Any system running those release candidates is vulnerable; no other vendor kernels are listed as impacted.

Risk and Exploitability

The CVSS score of 7.8 classifies the vulnerability as high severity, but the EPSS score of less than 1% indicates a very low current exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation would require an attacker to open an rxrpc socket with MSG_DONTWAIT (and possibly MSG_PEEK), triggering the erroneous requeue logic, potentially leading to kernel memory corruption and privilege escalation to root, although real‑world exploitation appears limited at present.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< 8fd3b5e297854a4da0f273169baf4b1b7b257b97
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< c198628f3fca5c874d93874c233014d336e09f64
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< c6cebcb4e0b3140ec2ace45c020a9049527385d1
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< 0464bf75590da75b8413c3e758c04647b4cdb3c6
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< cf969bddd6e69c5777fa89dc88402204e72f312a
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< 930114425065f7ace6e0c0630fab4af75e059ea8
`540b1c48c37ac0ad66212004db21e1ff7e2d78be`	affected	< 2c28769a51deb6022d7fbd499987e237a01dd63a

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.8`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the upstream kernel patch that fixes the unconditional requeue in rxrpc_recvmsg
Upgrade the system to a kernel newer than 6.19 rc6 (e.g., rc7 or a subsequent stable release that includes the fix)
If upgrade is not immediately feasible, temporarily disable or restrict applications that open rxrpc connections with MSG_DONTWAIT or MSG_PEEK to mitigate the risk

Generated by OpenCVE AI on October 23, 2026 at 08:49 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8570-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8594-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8604-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8605-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8570-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8669-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.122% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6
https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a
https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97
https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8
https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64
https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1
https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a
https://lore.kernel.org/linux-cve-announce/2026020416-CVE-2026-23066-8e44@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23066
https://www.cve.org/CVERecord?id=CVE-2026-23066

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Jun 1, 2026 5:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97 https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64 https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1

Apr 3, 2026 2:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mar 25, 2026 10:45 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6 https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a

Mar 13, 2026 9:30 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-674
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 5, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026020416-CVE-2026-23066-8e44@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23066 https://www.cve.org/CVERecord?id=CVE-2026-23066
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Feb 4, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it. The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns. Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it. Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also.
Title		rxrpc: Fix recvmsg() unconditional requeue
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8