Linux Kernel Vulnerability in rxrpc Functionality

CVE-2026-74435

What is CVE-2026-74435?

This vulnerability in the Linux kernel's rxrpc functionality could lead to potential issues when the rxrpc_call.rx_dec_buffer is unallocated. The function rxrpc_recvmsg_data() calls rxrpc_verify_data() and expects the rx_dec_buffer to be allocated upon return. However, if rxrpc_skb_priv.len is zero, the function may skip allocation, which can then lead to a call to skb_copy_bits() with a NULL destination. To mitigate this, rxrpc_verify_data() has been updated to always attempt allocation of the rx_dec_buffer when it is NULL, thereby addressing this security concern.

References