CVE-2026-74432

Received Received - Intake

rxrpc Kernel Memory Leak in recvmsg

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released call if MSG_PEEK is in force (the function holds a ref on the call irrespective of whether MSG_PEEK is specified or not).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74432

EUVD

EUVD-2026-59579

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where rxrpc_recvmsg() fails to properly release a reference to a call when MSG_PEEK is used. The function holds a reference to the call regardless of MSG_PEEK, but only drops it when MSG_PEEK is not specified, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's rxrpc subsystem and may not have direct detection commands. Monitor kernel logs for rxrpc-related errors or crashes. Check for unusual network activity involving rxrpc ports. Ensure your kernel is updated to a patched version.

Impact Analysis

This could lead to resource exhaustion in the Linux kernel, potentially causing system instability or crashes due to unreleased memory. It primarily affects systems using the rxrpc protocol for network communication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak issue in the Linux kernel's rxrpc subsystem that could lead to resource exhaustion but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the rxrpc module if it is not required by your system.

Hi! I’m here to help you understand CVE-2026-74432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70