CVE-2026-74436

Received Received - Intake

Race Condition in Linux Kernel rxrpc Socket Handling

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots. Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74436

EUVD

EUVD-2026-59583

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition where rxrpc_kernel_charge_accept() reads rx->backlog without proper synchronization, allowing rxrpc_discard_prealloc() to free the backlog rings concurrently. This can lead to a kernel preallocation worker using freed memory while updating backlog state.

Detection Guidance

This vulnerability is specific to the Linux kernel's rxrpc subsystem and may not have direct detection commands. Monitor kernel logs for rxrpc-related errors or crashes, particularly during socket operations. Check for kernel panics or unexpected behavior in network services using rxrpc.

Impact Analysis

This flaw could cause system instability, crashes, or potential privilege escalation if exploited. It may lead to memory corruption or unexpected behavior in network services using the rxrpc subsystem.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a kernel-level memory management issue in the Linux rxrpc subsystem. Compliance impacts would depend on system-specific configurations and data processing activities rather than this technical flaw.

Mitigation Strategies

Update the Linux kernel to the latest patched version that resolves this issue. Avoid using rxrpc kernel preallocation features if not critical. Monitor kernel logs for suspicious activity related to rxrpc backlog handling.

Hi! I’m here to help you understand CVE-2026-74436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70