SECUFOCUSNOW
Home›CVE index›CVE-2026-74435
ReviewHigh

CVE-2026-74435

Linux

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is...

CVSS
7.5
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.15
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is...

Affected product and versions

Product
Linux
Affected versions
>= a05bf6d9e621fa71e89ccebe3047ba45218d7b38 < 8bbede0afced346b24e4fbde0c68cf12980ba948, >= b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5 < 6563b4eb38c35d75892445bcf8aacdc29914821c, >= 46cb765e2e5ad52303ea157e10d370bb6b7acbbf < d3b642cf95d48234590cc91450d8705a9bf6b540, >= d2bc90cf6c75cb96d2ce549be6c35efa3099d25b < a962bc8508592c4d51092edac68579bd8b18fe44, >= d2bc90cf6c75cb96d2ce549be6c35efa3099d25b < 16c8ae9735c5bd7e54dd7478d6348e0fc860842d, >= c580087743712112778a06d65a4074053072d7bf, >= 6.6.143 < 6.6.145, >= 6.12.93 < 6.12.97, >= 6.18.35 < 6.18.40, >= 7.0.11 < 7.1, >= 7.1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available