CVE-2026-74435
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In the Linux kernel's rxrpc subsystem, rxrpc_verify_data does not always allocate the rx_dec_buffer, which can lead to a call to skb_copy_bits with a NULL destination and a NULL pointer dereference. The fix ensures allocation is always attempted when the buffer is NULL.
Risk Assessment
The risk includes potential system crashes due to NULL pointer dereference, which could lead to denial of service or data integrity issues.
Recommendation
Update the kernel to a version containing the fix that always attempts to allocate rx_dec_buffer when it is NULL.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.