Linux Kernel Vulnerability Affecting Socket Preallocation Process

CVE-2026-74436

What is CVE-2026-74436?

A serious vulnerability in the Linux kernel arises from improper synchronization during the socket teardown process. The function rxrpc_kernel_charge_accept() does not synchronize access to the rx->backlog variable, allowing for potential use of freed memory structures. As a result, when the backlog rings are freed, a concurrent worker can operate on these invalidated memory references, risking data corruption and system instability. The vulnerability has been mitigated by enforcing serialized state checks and backlog lookups in conjunction with the socket lock, rejecting kernel preallocations when the listening state is disabled or the service backlog is discarded.

References