369999 matches found
CVE-2026-74435
Summary (CVE-2026-74435) : In the Linux kernel, a fix was applied to rxrpc_verify_data and related code paths (rxrpc_recvmsg_data) to ensure rxdec_buffer is allocated when rx_dec_buffer is NULL. Previously, rxrpc_verify_data could return without allocating the buffer if rxrpc_skb_priv.len was zer...
CVE-2026-74436
CVE-2026-74436 affects the Linux kernel rxrpc subsystem. The issue arises when rxrpc_kernel_charge_accept() reads rx->backlog without proper socket/backlog synchronization, passing a raw pointer into rxrpc_service_prealloc_one() while a concurrent rxrpc_discard_prealloc() may set rx->backlo...
CVE-2026-74435 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...
CVE-2026-74436
In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...
CVE-2026-74435
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...
CVE-2026-74435 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...
CVE-2026-74434
The CVE-2026-74434 issue affects the Linux kernel rxrpc path: when reading an OOB message with MSG_PEEK, rxrpc_recvmsg_oob() unlinks from recvmsg_oobq but always moves the message onto pending_oobq, risking the sk_buff rbnode linkage being overwritten. This allows the skb to be reachable from bot...
CVE-2026-74434 rxrpc: Don't move a peeked OOB message onto the pending queue
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...
CVE-2026-74434 rxrpc: Don't move a peeked OOB message onto the pending queue
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...
CVE-2026-74434
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...
EUVD-2026-59581
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...
CVE-2026-74433
In the Linux kernel, CVE-2026-74433 describes a use-after-free (UAF) in rxgk_issue_challenge() within rxrpc. The bug occurs because a page containing the challenge content is freed after a tracepoint is invoked, while the whdr referenced by the tracepoint points into that same page. The fix updat...
CVE-2026-74432 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...
EUVD-2026-59579
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...
CVE-2026-74432 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...
CVE-2026-74432
The CVE-2026-74432 issue affects the Linux kernel’s rxrpc recvmsg path. The fix adds dropping of a reference on an already-released call when MSG_PEEK is in force, addressing a leak where a ref was held regardless of MSG_PEEK usage. Affected component: rxrpc_recvmsg() in the kernel; root cause: l...
EUVD-2026-59580
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgkissuechallenge Fix rxgkissuechallenge to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed...
CVE-2026-74433 rxrpc: Fix UAF in rxgk_issue_challenge()
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgkissuechallenge Fix rxgkissuechallenge to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed...
CVE-2026-74432
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...
CVE-2026-74433
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgkissuechallenge Fix rxgkissuechallenge to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed...