CVE-2026-74433
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.
Risk Assessment
The risk includes use-after-free, which could lead to system crashes or potential exploitation for code execution.
Recommendation
Update the kernel to a version containing the fix that frees the page after the tracepoint has used it.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk_issue_challenge() Fix rxgk_issue_challenge() to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed.