CVE-2026-23118
Data Race and Tearing in Linux Kernel rxrpc Component
Publication date: 2026-02-14
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 4.17 (inc) to 6.12.69 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a data-race warning and potential load/store tearing in the Linux kernel's rxrpc component. Specifically, there was a data-race issue in the functions rxrpc_peer_keepalive_worker and rxrpc_send_data_packet related to concurrent reads and writes to the last_tx_at field.
The problem arises because last_tx_at is a 64-bit value, and on 32-bit architectures, tearing can occur when accessing it without proper locking. The code was performing lockless accesses to last_tx_at, which was acceptable for approximate timing but caused warnings and potential issues.
The fix involved changing last_tx_at to an unsigned int that stores only the least significant word of the time64_t value. This avoids tearing and data-race warnings while still allowing reconstruction of the full time value when needed, assuming no more than 68 years have passed since the last transmission.
How can this vulnerability impact me? :
The vulnerability could lead to data-race conditions and potential tearing when accessing timing information in the rxrpc protocol within the Linux kernel. While the lockless access was intended to provide approximate timing, the data-race warnings indicate possible inconsistencies in reading or writing the last transmission time.
On 32-bit architectures, this could cause corrupted or inconsistent timing data, which might affect the correct transmission of keepalive packets in the rxrpc protocol. However, the vulnerability does not appear to cause direct security breaches or system crashes but rather timing inaccuracies.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know