Look up another CVE · open CVE-2026-74429 in the interactive tracker
CVE-2026-74429
rxrpc: Fix the reception of a reply packet before data transmission
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/rxrpc. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74429 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Fix rxrpc_receiving_reply() to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call by checking to see if the call has been exposed yet by sending the first packet. Without this, rxrpc_rotate_tx_window() might oops. Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by changing the do...while loop into a while loop, just in case a call is abnormally terminated by an early reply before the last request packet is transmitted.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/rxrpc/input.c
- What this is
- RXRPC SOCKETS (AF_RXRPC)MAINTAINERS section matched on net/rxrpc/ · linux-afs@lists.infradead.org · Supported
- Kernel module
- rxrpc
Check it on the machine
grep -w CONFIG_AF_RXRPC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w rxrpcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_AF_RXRPC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.61%, higher than 48.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/rxrpc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.14 | 6.18.40 | f9be51498447 |
| 6.14 | 7.1.5 | e220ae559e5a |
| 6.14 | 7.2 | a58e33405acd |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached when a remote UDP RxRPC DATA reply is processed on an established client call via rxrpc_encap_rcv(), rxrpc_input_packet_on_conn(), and rxrpc_input_data(); a malicious or compromised AFS/RxRPC server peer can send that early reply over the network to any kAFS/AF_RXRPC client.
- AC:LAttack complexity, low
- The remote server controls both sides of the timing race—it can send a reply DATA packet immediately after the client call is live on the channel but before RXRPC_CALL_EXPOSED/first transmit—and can retry on every RPC without depending on memory layout or other uncontrollable conditions.
- PR:NPrivileges required, none
- No local credentials or kernel capabilities on the victim are required; exploitation only needs the attacker to act as the established RxRPC server peer able to send call-bound DATA packets on an active client connection after the normal security handshake.
- UI:NUser interaction, none
- Once the victim host has an active client call (normal kAFS file access or AF_RXRPC sendmsg), the kernel rxrpc I/O thread autonomously processes the attacker's early reply with no further interactive victim action at exploit time.
- S:UScope, unchanged
- The oops in rxrpc_rotate_tx_window() affects only kernel memory and threads within the same security authority on the client host; it does not cross VM, container, IOMMU, or sandbox boundaries.
- C:NConfidentiality impact, none
- The defect is a NULL dereference from a do...while loop that executes once on an empty Tx queue when seq exceeds tx_top (tq or tq->bufs[ix] is NULL); this is a pure crash path, not an out-of-bounds read or use-after-free disclosure primitive.
- I:NIntegrity impact, none
- No attacker-controlled memory is written; the failure dereferences NULL or uninitialized txqueue entries before any buffer rotation or put_txbuf logic completes, yielding only a kernel fault without integrity modification capability.
- A:HAvailability impact, high
- Without the fix, rxrpc_rotate_tx_window() oopses the rxrpc I/O kernel thread that services all RxRPC/AFS traffic on that endpoint; a malicious server can trigger this on every client RPC call, causing repeated kernel crashes or hangs.