CVE-2026-23118

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23118", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.969Z", "datePublished": "2026-02-14T15:09:49.845Z", "dateUpdated": "2026-11-05T21:23:17.922Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:43.092Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix data-race warning and potential load/store tearing\n\nFix the following:\n\n BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\n\nwhich is reporting an issue with the reads and writes to ->last_tx_at in:\n\n conn->peer->last_tx_at = ktime_get_seconds();\n\nand:\n\n keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;\n\nThe lockless accesses to these to values aren't actually a problem as the\nread only needs an approximate time of last transmission for the purposes\nof deciding whether or not the transmission of a keepalive packet is\nwarranted yet.\n\nAlso, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit\narch.\n\nFix both of these by switching to an unsigned int for ->last_tx_at and only\nstoring the LSW of the time64_t. It can then be reconstructed at need\nprovided no more than 68 years has elapsed since the last transmission."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "versions": [{"version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "49b8ef1abfe7713e15d9128006cb76e413b12b57", "status": "affected", "versionType": "git"}, {"version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "a426f29ac3fa3465093567ab763ada46762fb57c", "status": "affected", "versionType": "git"}, {"version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "c08cf314191cd0f8699089715efb9eff030f0086", "status": "affected", "versionType": "git"}, {"version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "f8cf1368e0a5491b27189a695c36f64e48f3d19d", "status": "affected", "versionType": "git"}, {"version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.69", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/49b8ef1abfe7713e15d9128006cb76e413b12b57"}, {"url": "https://git.kernel.org/stable/c/a426f29ac3fa3465093567ab763ada46762fb57c"}, {"url": "https://git.kernel.org/stable/c/c08cf314191cd0f8699089715efb9eff030f0086"}, {"url": "https://git.kernel.org/stable/c/f8cf1368e0a5491b27189a695c36f64e48f3d19d"}, {"url": "https://git.kernel.org/stable/c/5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b"}], "title": "rxrpc: Fix data-race warning and potential load/store tearing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:55.807640Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:17.922Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:55.807640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:19:56.810Z"}}], "cna": {"title": "rxrpc: Fix data-race warning and potential load/store tearing", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "49b8ef1abfe7713e15d9128006cb76e413b12b57", "versionType": "git"}, {"status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "a426f29ac3fa3465093567ab763ada46762fb57c", "versionType": "git"}, {"status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "c08cf314191cd0f8699089715efb9eff030f0086", "versionType": "git"}, {"status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "f8cf1368e0a5491b27189a695c36f64e48f3d19d", "versionType": "git"}, {"status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "lessThan": "5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b", "versionType": "git"}], "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"status": "unaffected", "version": "0", "lessThan": "4.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.69", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.8", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/49b8ef1abfe7713e15d9128006cb76e413b12b57"}, {"url": "https://git.kernel.org/stable/c/a426f29ac3fa3465093567ab763ada46762fb57c"}, {"url": "https://git.kernel.org/stable/c/c08cf314191cd0f8699089715efb9eff030f0086"}, {"url": "https://git.kernel.org/stable/c/f8cf1368e0a5491b27189a695c36f64e48f3d19d"}, {"url": "https://git.kernel.org/stable/c/5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix data-race warning and potential load/store tearing\n\nFix the following:\n\n BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\n\nwhich is reporting an issue with the reads and writes to ->last_tx_at in:\n\n conn->peer->last_tx_at = ktime_get_seconds();\n\nand:\n\n keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;\n\nThe lockless accesses to these to values aren't actually a problem as the\nread only needs an approximate time of last transmission for the purposes\nof deciding whether or not the transmission of a keepalive packet is\nwarranted yet.\n\nAlso, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit\narch.\n\nFix both of these by switching to an unsigned int for ->last_tx_at and only\nstoring the LSW of the time64_t. It can then be reconstructed at need\nprovided no more than 68 years has elapsed since the last transmission."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.69", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.8", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "4.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:43.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23118", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:17.922Z", "dateReserved": "2026-01-13T15:37:45.969Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T15:09:49.845Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "49b8ef1abfe7713e15d9128006cb76e413b12b57", "status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "versionType": "git"}, {"lessThan": "a426f29ac3fa3465093567ab763ada46762fb57c", "status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "versionType": "git"}, {"lessThan": "c08cf314191cd0f8699089715efb9eff030f0086", "status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "versionType": "git"}, {"lessThan": "f8cf1368e0a5491b27189a695c36f64e48f3d19d", "status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "versionType": "git"}, {"lessThan": "5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b", "status": "affected", "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/conn_event.c", "net/rxrpc/output.c", "net/rxrpc/peer_event.c", "net/rxrpc/proc.c", "net/rxrpc/rxgk.c", "net/rxrpc/rxkad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.69", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "713E32F5-ABC9-4956-92EE-0E2944AD563A", "versionEndExcluding": "6.12.69", "versionStartIncluding": "4.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E65C6E79-7EBE-4C77-93F0-818CF5B38F4E", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix data-race warning and potential load/store tearing\n\nFix the following:\n\n BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\n\nwhich is reporting an issue with the reads and writes to ->last_tx_at in:\n\n conn->peer->last_tx_at = ktime_get_seconds();\n\nand:\n\n keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;\n\nThe lockless accesses to these to values aren't actually a problem as the\nread only needs an approximate time of last transmission for the purposes\nof deciding whether or not the transmission of a keepalive packet is\nwarranted yet.\n\nAlso, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit\narch.\n\nFix both of these by switching to an unsigned int for ->last_tx_at and only\nstoring the LSW of the time64_t. It can then be reconstructed at need\nprovided no more than 68 years has elapsed since the last transmission."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Corregir la advertencia de condici\u00f3n de carrera de datos y el potencial desgarro de carga/almacenamiento\n\nCorregir lo siguiente:\n\n BUG: KCSAN: condici\u00f3n de carrera de datos en rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\n\nque est\u00e1 informando un problema con las lecturas y escrituras a ->last_tx_at en:\n\n conn->peer->last_tx_at = ktime_get_seconds();\n\ny:\n\n keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;\n\nLos accesos sin bloqueo a estos dos valores no son realmente un problema, ya que la lectura solo necesita un tiempo aproximado de la \u00faltima transmisi\u00f3n con el prop\u00f3sito de decidir si la transmisi\u00f3n de un paquete keepalive est\u00e1 justificada o no.\n\nAdem\u00e1s, como ->last_tx_at es un valor de 64 bits, puede ocurrir desgarro en una arquitectura de 32 bits.\n\nCorregir ambos cambiando a un unsigned int para ->last_tx_at y almacenando solo el LSW del time64_t. Luego puede ser reconstruido cuando sea necesario, siempre que no hayan transcurrido m\u00e1s de 68 a\u00f1os desde la \u00faltima transmisi\u00f3n."}], "id": "CVE-2026-23118", "lastModified": "2026-11-05T22:18:03.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23118", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:19:55.807640Z", "version": "2.0.3"}}]}, "published": "2026-02-14T15:16:06.933", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49b8ef1abfe7713e15d9128006cb76e413b12b57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a426f29ac3fa3465093567ab763ada46762fb57c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c08cf314191cd0f8699089715efb9eff030f0086"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f8cf1368e0a5491b27189a695c36f64e48f3d19d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix data-race warning and potential load/store tearing", "id": "2439860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439860"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: Fix data-race warning and potential load/store tearing\nFix the following:\nBUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet\nwhich is reporting an issue with the reads and writes to ->last_tx_at in:\nconn->peer->last_tx_at = ktime_get_seconds();\nand:\nkeepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;\nThe lockless accesses to these to values aren't actually a problem as the\nread only needs an approximate time of last transmission for the purposes\nof deciding whether or not the transmission of a keepalive packet is\nwarranted yet.\nAlso, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit\narch.\nFix both of these by switching to an unsigned int for ->last_tx_at and only\nstoring the LSW of the time64_t. It can then be reconstructed at need\nprovided no more than 68 years has elapsed since the last transmission."], "name": "CVE-2026-23118", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23118\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23118\nhttps://lore.kernel.org/linux-cve-announce/2026021407-CVE-2026-23118-7579@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ace45bec6d77bc061c3c3d8ad99e298ea9800c2b,c08cf314191cd0f8699089715efb9eff030f0086)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ace45bec6d77bc061c3c3d8ad99e298ea9800c2b,f8cf1368e0a5491b27189a695c36f64e48f3d19d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ace45bec6d77bc061c3c3d8ad99e298ea9800c2b,5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.69,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.8,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-16T06:50:16.783030+00:00", "value": {"mitigation_remediation": ["Upgrade to a kernel version that includes the rxrpc last_tx_at fix, such as Linux kernel 6.19 final or newer.", "If immediate upgrade is not possible, backport the relevant commit(s) to the existing kernel to replace the 64-bit field with a 32\u2011bit unsigned int, following the upstream patch.", "After applying the patch, monitor kernel logs for any remaining KCSAN data\u2011race or timing anomalies to confirm the issue is resolved."], "summary": {"action": "Assess Impact", "impact": "Data Race and Potential Load/Store Tearing"}, "threat_synthesis": {"affected_systems": "Affected systems are Linux kernels that include the rxrpc implementation. The known affected range covers kernel version 6.19 release candidates 1 through 6, as indicated by the CPE entries, and any future kernels that have not yet incorporated the patch.", "description_and_impact": "The vulnerability involves a data race and potential load/store tearing in the Linux kernel's rxrpc module. Concurrent reads and writes to the last_tx_at field can produce inconsistent values, and on 32\u2011bit architectures, the 64\u2011bit value may tear, resulting in inaccurate timing data. This can lead to incorrect keep\u2011alive packet decisions, potentially causing subtle timing errors or availability issues but does not provide direct control over the system.", "risk_and_exploitability": "The CVSS score of 4.7 indicates low severity. EPSS is below 1%, and the vulnerability is not flagged in the CISA KEV catalog, suggesting a low likelihood of exploitation. The attack vector is likely local and indirect; an attacker would need to influence the kernel\u2019s rxrpc timing logic, which is not trivial. Overall risk remains low with minimal impact on confidentiality or integrity."}}}}, "created": "2026-02-16T12:01:46.834167+00:00", "updated": "2026-04-16T07:00:10.980887+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}