Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-74435

rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero. In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference. To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL. This issue was identified with assistance of a private sashiko instance.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • a05bf6d9e621fa71e89ccebe3047ba45218d7b38 to < 8bbede0afced346b24e4fbde0c68cf12980ba948affected
  • b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5 to < 6563b4eb38c35d75892445bcf8aacdc29914821caffected
  • 46cb765e2e5ad52303ea157e10d370bb6b7acbbf to < d3b642cf95d48234590cc91450d8705a9bf6b540affected
  • d2bc90cf6c75cb96d2ce549be6c35efa3099d25b to < a962bc8508592c4d51092edac68579bd8b18fe44affected
  • d2bc90cf6c75cb96d2ce549be6c35efa3099d25b to < 16c8ae9735c5bd7e54dd7478d6348e0fc860842daffected
  • c580087743712112778a06d65a4074053072d7bfaffected
  • 6.6.143 to < 6.6.145affected
  • 6.12.93 to < 6.12.97affected
  • 6.18.35 to < 6.18.40affected
  • 7.0.11 to < 7.1affected

Linux Linux

Default version status: affected

  • 7.1affected
  • 0 to < 7.1unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References