Description
In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Don't move a peeked OOB message onto the pending queue

rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
if a response is needed, moves it onto the pending_oobq tree. However,
only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto
pending_oobq always runs.

As a result, reading a challenge with MSG_PEEK leaves the skb on
recvmsg_oobq while also adding it to pending_oobq. Since struct
sk_buff's rbnode shares storage with its next and prev pointers,
rb_insert_color() overwrites the list linkage, and the skb, which holds
a single reference, becomes reachable from both queues at once.

When the socket is closed both queues are drained in turn. While
draining recvmsg_oobq, __skb_unlink() follows the next and prev
pointers that rbnode has overwritten and writes to a bad address. Also,
as the skb holds a single reference but is freed from each queue, both
the skb and the connection reference it holds are released twice. This
leads to memory corruption and to a use-after-free caused by the
connection refcount underflow.

MSG_PEEK does not consume the message from the queue, so only unlink it
from recvmsg_oobq and then move it onto pending_oobq or free it when
the message is actually consumed.
Published: 2026-08-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel’s rxrpc implementation contains a logic error in rxrpc_recvmsg_oob() where an out‑of‑band message that is only peeked is still moved onto the pending_oobq queue unconditionally. This double reference to the same sk_buff results in a double unlink and double free, producing a use‑after‑free bug. The memory corruption can cause a crash or disrupt kernel operation.

Affected Systems

All Linux kernel releases that have not incorporated the patch referenced in the advisory commits (5801cff7d5d7b4e9d877dfb627b23eb63167f02c, 5f470cc883416fea6d3bce18ef96bf91dd49ffc3, or 9ada3931beb37068fcb725b34b0398457009f343) are impacted. This spans distributions that ship with earlier kernels; the bug resides in the core rxrpc networking code and is not confined to a specific vendor branching.

Risk and Exploitability

Based on the description, it is inferred that the trigger requires a socket performing MSG_PEEK on a stateful rxrpc connection, which an attacker can craft if the target accepts untrusted rxrpc traffic. The EPSS score of <1% indicates a very low probability of exploitation, although the use‑after‑free nature suggests a high‑impact event if triggered. The vulnerability is not listed in CISA KEV, indicating no widespread exploitation has been documented, yet the kernel’s ubiquity presents a significant attack surface. The CVSS score of 9.8 indicates a critical severity level.

Generated by OpenCVE AI on August 21, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that incorporates the rxrpc patch referenced in the advisory commits.
  • If an immediate kernel upgrade is not possible, block or disable the rxrpc protocol on ingress traffic using firewall rules or by unloading the rxrpc module if supported.
  • Deploy a local patch that adds a guard to the MSG_PEEK handling in rxrpc_recvmsg_oob() to prevent double unlinking or use the reference commits to patch the issue when upgrades cannot be performed.

Generated by OpenCVE AI on August 21, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 17 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 17 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 15 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto pending_oobq always runs. As a result, reading a challenge with MSG_PEEK leaves the skb on recvmsg_oobq while also adding it to pending_oobq. Since struct sk_buff's rbnode shares storage with its next and prev pointers, rb_insert_color() overwrites the list linkage, and the skb, which holds a single reference, becomes reachable from both queues at once. When the socket is closed both queues are drained in turn. While draining recvmsg_oobq, __skb_unlink() follows the next and prev pointers that rbnode has overwritten and writes to a bad address. Also, as the skb holds a single reference but is freed from each queue, both the skb and the connection reference it holds are released twice. This leads to memory corruption and to a use-after-free caused by the connection refcount underflow. MSG_PEEK does not consume the message from the queue, so only unlink it from recvmsg_oobq and then move it onto pending_oobq or free it when the message is actually consumed.
Title rxrpc: Don't move a peeked OOB message onto the pending queue
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:47:08.797Z

Reserved: 2026-08-15T05:44:03.896Z

Link: CVE-2026-74434

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:45.510

Modified: 2026-08-17T06:19:39.030

Link: CVE-2026-74434

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74434 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:30:17Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-416

    Use After Free