CVE-2026-74435 - Vulnerability Details

- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.

In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.

To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.

This issue was identified with assistance of a private
sashiko instance.

Published: 2026-08-15

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In Linux kernel, the rxrpc_verify_data function fails to allocate the rx_dec_buffer when the packet length is zero. This causes skb_copy_bits to attempt a write to a NULL destination, leading to a kernel panic. The result is a system reboot or loss of kernel availability, representing a denial of service attack.

Affected Systems

All Linux kernel implementations that include the rxrpc protocol handler and have not applied the patch that guarantees buffer allocation. The description does not specify versions, so any kernel snapshot preceding the referenced commit may be vulnerable.

Risk and Exploitability

Based on the description, it appears that the flaw could be triggered remotely by sending a crafted rxrpc packet with zero length. EPSS score of < 1% indicates a very low probability of exploitation in the wild. The CVSS score of 7.5 reflects high severity. The network‑based trigger and potential for a complete crash suggest high impact for systems that expose rxrpc services to untrusted networks, and the vulnerability is not listed in CISA KEV.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a05bf6d9e621fa71e89ccebe3047ba45218d7b38`	affected	< 8bbede0afced346b24e4fbde0c68cf12980ba948
`b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5`	affected	< 6563b4eb38c35d75892445bcf8aacdc29914821c
`46cb765e2e5ad52303ea157e10d370bb6b7acbbf`	affected	< d3b642cf95d48234590cc91450d8705a9bf6b540
`d2bc90cf6c75cb96d2ce549be6c35efa3099d25b`	affected	< a962bc8508592c4d51092edac68579bd8b18fe44
`d2bc90cf6c75cb96d2ce549be6c35efa3099d25b`	affected	< 16c8ae9735c5bd7e54dd7478d6348e0fc860842d
`c580087743712112778a06d65a4074053072d7bf`	affected	—
`6.6.143`	affected	< 6.6.145
`6.12.93`	affected	< 6.12.97
`6.18.35`	affected	< 6.18.40
`7.0.11`	affected	< 7.1

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a05bf6d9e621fa71e89ccebe3047ba45218d7b38,8bbede0afced346b24e4fbde0c68cf12980ba948)`	affected	code_commit	—
`[b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5,6563b4eb38c35d75892445bcf8aacdc29914821c)`	affected	code_commit	—
`[6563b4eb38c35d75892445bcf8aacdc29914821c,8bbede0afced346b24e4fbde0c68cf12980ba948)`	affected	code_commit	—
`[46cb765e2e5ad52303ea157e10d370bb6b7acbbf,d3b642cf95d48234590cc91450d8705a9bf6b540)`	affected	code_commit	—
`[d2bc90cf6c75cb96d2ce549be6c35efa3099d25b,a962bc8508592c4d51092edac68579bd8b18fe44)`	affected	code_commit	—
`[d2bc90cf6c75cb96d2ce549be6c35efa3099d25b,16c8ae9735c5bd7e54dd7478d6348e0fc860842d)`	affected	code_commit	—
`c580087743712112778a06d65a4074053072d7bf`	affected	code_commit	—
`[6.6.143,6.6.145)`	affected	semver	—
`[6.12.93,6.12.97)`	affected	semver	—
`[7.0.11,7.1)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	semver	—
`[0,7.1)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch from the commit logs referenced in the advisory.
If a kernel upgrade cannot be performed immediately, block or rate‑limit inbound rxrpc traffic using host‑based firewall rules to prevent the fault from being triggered.
Disable or uninstall services that use the rxrpc protocol if it is not required for system operation.

Generated by OpenCVE AI on August 17, 2026 at 14:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00346.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/16c8ae9735c5bd7e54dd7478d6348e0fc860842d
https://git.kernel.org/stable/c/6563b4eb38c35d75892445bcf8aacdc29914821c
https://git.kernel.org/stable/c/8bbede0afced346b24e4fbde0c68cf12980ba948
https://git.kernel.org/stable/c/a962bc8508592c4d51092edac68579bd8b18fe44
https://git.kernel.org/stable/c/d3b642cf95d48234590cc91450d8705a9bf6b540
https://lore.kernel.org/linux-cve-announce/2026081515-CVE-2026-74435-906c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74435
https://www.cve.org/CVERecord?id=CVE-2026-74435

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081515-CVE-2026-74435-906c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74435 https://www.cve.org/CVERecord?id=CVE-2026-74435
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 17 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 15 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.
Title		rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/16c8ae9735c5bd7e54dd7478d6348e0fc860842d https://git.kernel.org/stable/c/6563b4eb38c35d75892445bcf8aacdc29914821c https://git.kernel.org/stable/c/8bbede0afced346b24e4fbde0c68cf12980ba948 https://git.kernel.org/stable/c/a962bc8508592c4d51092edac68579bd8b18fe44 https://git.kernel.org/stable/c/d3b642cf95d48234590cc91450d8705a9bf6b540

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:59:34.073Z

Updated: 2026-08-17T05:47:09.898Z

Reserved: 2026-08-15T05:44:03.896Z

Link: CVE-2026-74435

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:45.607

Modified: 2026-08-17T06:19:39.153

Link: CVE-2026-74435

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74435 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T14:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object