rxrpc: serialize kernel accept preallocation with socket teardown (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.40 % · percentile 34 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots. Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.
References
- https://git.kernel.org/stable/c/d6207326b4ca0ae1041281b6af9df53f8080669a
- https://git.kernel.org/stable/c/11b429b84c87cb5a0152f14e7d6cb649ed363901
- https://git.kernel.org/stable/c/c20d983968f239574290cf804a58cde18ad1c559
- https://git.kernel.org/stable/c/0337cdba0c477f176c0459bed012109453184573
- https://git.kernel.org/stable/c/dfa0b2bbc5e50119f89c6b5407faa5ed86dfa7c5
- https://git.kernel.org/stable/c/35a967ff8b24db09ee429c39c5b5e6571639997d
- https://git.kernel.org/stable/c/1741378a7a83dfd8e53a9196730df709b903cd33
- https://git.kernel.org/stable/c/dc175389b18c29a5303ee83169ec653adfae3e17
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-59583
- GCVE · GCVE-0-2026-74436
CERT-FR advisories
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < d6207326b4ca0ae1041281b6af9df53f8080669a ; affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 11b429b84c87cb5a0152f14e7d6cb649ed363901 ; affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < c20d983968f239574290cf804a58cde18ad1c559 ; affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 0337cdba0c477f176c0459bed012109453184573 ; affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < dfa0b2bbc5e50119f89c6b5407faa5ed86dfa7c5 ; affected 00e907127e6f86d0f9b122d9b4347a8aa09a8b61 < 35a967ff8b24db09ee429c39c5b5e6571639997d |
| Linux · Linux | affected 4.9 ; unaffected 0 < 4.9 ; unaffected 5.10.266 ≤ 5.10.* ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.184 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |