CVE-2026-74436
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.
Risk Assessment
The risk includes potential memory corruption, system crashes, or unauthorized data access, which could lead to security breaches.
Recommendation
Update the kernel to a version containing the fix that serializes the state check and backlog lookup with the socket lock and rejects preallocation after teardown.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots. Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.