CVE-2026-43463
Kernel NULL Pointer Dereference in Linux rxrpc and afs
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability involves a missing error pointer check in the Linux kernel's rxrpc and afs components. Specifically, rxrpc_kernel_lookup_peer() can return error pointers in addition to NULL, but the code only checked for NULL, which is insufficient.
The impact could be that error conditions are not properly handled, potentially leading to incorrect behavior or crashes in the kernel components that rely on this function.
The fix involves changing the function to return a specific error code (-ENOMEM) instead of NULL on allocation failure and updating callers to properly check for error pointers.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rxrpc and afs components. The issue is due to a missing error pointer check after the function rxrpc_kernel_lookup_peer() is called. This function can return error pointers in addition to NULL, but previously only NULL was checked, which is insufficient.
The fix involved changing rxrpc_kernel_lookup_peer() to return a specific error code (-ENOMEM) instead of NULL when an allocation failure occurs, and updating the callers in afs to properly check for error pointers using IS_ERR() and PTR_ERR() macros.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the rxrpc and afs components have been fixed to properly handle error pointers after rxrpc_kernel_lookup_peer(). This includes the changes where rxrpc_kernel_lookup_peer() returns -ENOMEM instead of NULL on allocation failure and callers use IS_ERR() and PTR_ERR() to handle error codes correctly.