CVE-2026-74435

Received Received - Intake

rxrpc_verify_data NULL Pointer Dereference in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74435

EUVD

EUVD-2026-59582

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's rxrpc component. It involves a flaw where rxrpc_verify_data() fails to allocate memory for rx_dec_buffer when rxrpc_skb_priv.len is zero. This can lead to a NULL pointer dereference if allocation fails, as skb_copy_bits() is called with a NULL destination.

Detection Guidance

This vulnerability is specific to the Linux kernel's rxrpc subsystem and may not have direct detection commands. Monitor kernel logs for NULL pointer dereference errors or crashes in rxrpc-related processes. Check for kernel oops messages or system crashes involving network services using rxrpc.

Impact Analysis

This vulnerability could cause system crashes or instability due to NULL pointer dereferences. If exploited, it may lead to denial-of-service conditions or potential unauthorized access in systems using the affected Linux kernel component.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if it affects systems handling personal or health data. A NULL pointer dereference in the Linux kernel's rxrpc module may lead to crashes or unexpected behavior, potentially causing data processing disruptions or security gaps. However, the provided CVE details do not explicitly link this issue to compliance requirements.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable the rxrpc module if not in use. Monitor kernel logs for signs of exploitation or crashes. Apply kernel hardening measures if available.

Hi! I’m here to help you understand CVE-2026-74435. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70