CVE-2026-74435
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.
How to fix
- Linux Linux8bbede0afced346b24e4fbde0c68cf12980ba948, 6563b4eb38c35d75892445bcf8aacdc29914821c, d3b642cf95d48234590cc91450d8705a9bf6b540, a962bc8508592c4d51092edac68579bd8b18fe44, 16c8ae9735c5bd7e54dd7478d6348e0fc860842d, 6.6.145, 6.12.97, 6.18.40, 7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a05bf6d9e621fa71e89ccebe3047ba45218d7b38 ≤ v < 8bbede0afced346b24e4fbde0c68cf12980ba948, b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5 ≤ v < 6563b4eb38c35d75892445bcf8aacdc29914821c, 46cb765e2e5ad52303ea157e10d370bb6b7acbbf ≤ v < d3b642cf95d48234590cc91450d8705a9bf6b540, d2bc90cf6c75cb96d2ce549be6c35efa3099d25b ≤ v < a962bc8508592c4d51092edac68579bd8b18fe44, d2bc90cf6c75cb96d2ce549be6c35efa3099d25b ≤ v < 16c8ae9735c5bd7e54dd7478d6348e0fc860842d, c580087743712112778a06d65a4074053072d7bf, 6.6.143 ≤ v < 6.6.145, 6.12.93 ≤ v < 6.12.97, 6.18.35 ≤ v < 6.18.40, 7.0.11 ≤ v < 7.1, 7.1 | 8bbede0afced346b24e4fbde0c68cf12980ba948, 6563b4eb38c35d75892445bcf8aacdc29914821c, d3b642cf95d48234590cc91450d8705a9bf6b540, a962bc8508592c4d51092edac68579bd8b18fe44, 16c8ae9735c5bd7e54dd7478d6348e0fc860842d, 6.6.145, 6.12.97, 6.18.40, 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.