9.8

CVE-2026-74436

rxrpc: serialize kernel accept preallocation with socket teardown

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: serialize kernel accept preallocation with socket teardown

rxrpc_kernel_charge_accept() reads rx->backlog without any
socket/backlog synchronization and passes that raw pointer into
rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()
sets rx->backlog = NULL and frees the backlog rings, so a kernel
preallocation worker can keep using a freed struct rxrpc_backlog
while updating *_backlog_head/tail and array slots.

Serialize the state check and backlog lookup with the socket lock,
and reject kernel preallocation once teardown has disabled
listening or discarded the service backlog.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < d6207326b4ca0ae1041281b6af9df53f8080669a
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < 11b429b84c87cb5a0152f14e7d6cb649ed363901
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < c20d983968f239574290cf804a58cde18ad1c559
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < 0337cdba0c477f176c0459bed012109453184573
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < dfa0b2bbc5e50119f89c6b5407faa5ed86dfa7c5
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < 35a967ff8b24db09ee429c39c5b5e6571639997d
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < 1741378a7a83dfd8e53a9196730df709b903cd33
Status affected
Version 00e907127e6f86d0f9b122d9b4347a8aa09a8b61
Version < dc175389b18c29a5303ee83169ec653adfae3e17
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.9
Status affected
Version 0
Version < 4.9
Status unaffected
Version <= 5.10.*
Version 5.10.266
Status unaffected
Version <= 5.15.*
Version 5.15.217
Status unaffected
Version <= 6.1.*
Version 6.1.184
Status unaffected
Version <= 6.6.*
Version 6.6.148
Status unaffected
Version <= 6.12.*
Version 6.12.101
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.294
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/0337cdba0c477f176c0459bed012109453184573
https://git.kernel.org/stable/c/dfa0b2bbc5e50119f89c6b5407faa5ed86dfa7c5
https://git.kernel.org/stable/c/35a967ff8b24db09ee429c39c5b5e6571639997d
https://git.kernel.org/stable/c/1741378a7a83dfd8e53a9196730df709b903cd33
https://git.kernel.org/stable/c/dc175389b18c29a5303ee83169ec653adfae3e17
https://git.kernel.org/stable/c/11b429b84c87cb5a0152f14e7d6cb649ed363901
https://git.kernel.org/stable/c/c20d983968f239574290cf804a58cde18ad1c559
https://git.kernel.org/stable/c/d6207326b4ca0ae1041281b6af9df53f8080669a