SECUFOCUSNOW
Home›CVE index›CVE-2026-74436
ReviewCritical

CVE-2026-74436

Linux

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots. Serialize the state check and backlog lookup with the socket lock, and reject kernel preal...

CVSS
9.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.15
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots. Serialize the state check and backlog lookup with the socket lock, and reject kernel preal...

Affected product and versions

Product
Linux
Affected versions
>= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < d6207326b4ca0ae1041281b6af9df53f8080669a, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 11b429b84c87cb5a0152f14e7d6cb649ed363901, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < c20d983968f239574290cf804a58cde18ad1c559, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 0337cdba0c477f176c0459bed012109453184573, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < dfa0b2bbc5e50119f89c6b5407faa5ed86dfa7c5, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 35a967ff8b24db09ee429c39c5b5e6571639997d, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 1741378a7a83dfd8e53a9196730df709b903cd33, >= 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < dc175389b18c29a5303ee83169ec653adfae3e17, >= 4.9
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available