CVE-2026-74430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74430", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.895Z", "datePublished": "2026-08-15T05:59:30.965Z", "dateUpdated": "2026-08-17T05:47:05.522Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:47:05.522Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix ACKALL packet handling\n\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\ncall is in a state that can legitimately have outstanding transmit buffers.\nA forged ACKALL can therefore reach a new service call in\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\n\nIn that state call->tx_top is zero and call->tx_queue is NULL, so\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\nnull-pointer dereference.\n\nFix the handling of ACKALL packets by the following means:\n\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\n that the client call is connected, but nothing has been transmitted as\n yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\n has been transmitted at least once, but we're now waiting for the\n stuff remaining in the Tx buffer to be ACK'd (retransmissions may\n still happen).\n\n The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\n a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\n first packet is transmitted.\n\n RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\n that all Tx packets have been ACK'd and we're now waiting for the\n reply to be received.\n\n (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks\n that the call state is one in which there might be stuff in the Tx\n buffer to ACK, but now this includes AWAIT_ACK rather than\n AWAIT_REPLY. ACKALL packets are ignored if received in the wrong\n state.\n\n Note that unlike Wyatt Feng's patch, it's no longer necessary to check\n to see if the Tx buffer exists as this the state set now covers this.\n\n (3) Make the ACKALL handler use call->tx_transmitted rather than\n call->tx_top as the former is explicitly the highest packet seq number\n transmitted, whereas the latter has a looser definition.\n\nThanks to Jeffrey Altman for a description of the history of the ACKALL\npacket[1]."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Forged ACKALL packets reach rxrpc_input_ackall() via UDP through rxrpc_encap_rcv() and the normal RxRPC receive path on internet-reachable AFS/AF_RXRPC servers without local access.\nAC:L - The attacker opens the call with DATA then immediately sends ACKALL while the server call is in RXRPC_CALL_SERVER_RECV_REQUEST, reliably triggering the NULL tx_queue dereference without races or special timing.\nPR:N - Only network access to an RxRPC listener is required; ACKALL is not cryptographically verified on input and the crash occurs on new service calls before reply transmission, including during pre-authentication connection setup.\nUI:N - No victim user action is required beyond a host running an affected RxRPC/AFS service; exploitation is accomplished entirely by attacker-crafted network packets.\nS:U - The vulnerability causes a kernel NULL-pointer dereference and crash within the RxRPC subsystem on the same host, not a cross-boundary escape such as VM guest-to-host or sandbox breakout.\nC:N - This is a pure NULL-pointer dereference with no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data to the attacker.\nI:N - No memory corruption or attacker-controlled writes occur; the fault path only dereferences a NULL tx_queue pointer and cannot be leveraged for arbitrary modification or code execution.\nA:H - A forged ACKALL in an invalid call state causes rxrpc_rotate_tx_window() to dereference NULL call->tx_queue, producing a kernel oops or panic and denying availability of the RxRPC/AFS server and potentially the entire host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/call_event.c", "net/rxrpc/call_object.c", "net/rxrpc/conn_client.c", "net/rxrpc/input.c", "net/rxrpc/sendmsg.c"], "versions": [{"version": "b341a0263b1b804d329f864c2dc24815364510ec", "lessThan": "8db6a2c95e36938076b37466ce36774526a5c8c3", "status": "affected", "versionType": "git"}, {"version": "b341a0263b1b804d329f864c2dc24815364510ec", "lessThan": "523cb585672ae681b2d3b0d620aec5313774e2e2", "status": "affected", "versionType": "git"}, {"version": "b341a0263b1b804d329f864c2dc24815364510ec", "lessThan": "9b6ce594808580b2a19e6e1aa459ef56c0153ac1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/call_event.c", "net/rxrpc/call_object.c", "net/rxrpc/conn_client.c", "net/rxrpc/input.c", "net/rxrpc/sendmsg.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3"}, {"url": "https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2"}, {"url": "https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1"}], "title": "rxrpc: Fix ACKALL packet handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/call_event.c", "net/rxrpc/call_object.c", "net/rxrpc/conn_client.c", "net/rxrpc/input.c", "net/rxrpc/sendmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8db6a2c95e36938076b37466ce36774526a5c8c3", "status": "affected", "version": "b341a0263b1b804d329f864c2dc24815364510ec", "versionType": "git"}, {"lessThan": "523cb585672ae681b2d3b0d620aec5313774e2e2", "status": "affected", "version": "b341a0263b1b804d329f864c2dc24815364510ec", "versionType": "git"}, {"lessThan": "9b6ce594808580b2a19e6e1aa459ef56c0153ac1", "status": "affected", "version": "b341a0263b1b804d329f864c2dc24815364510ec", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rxrpc/ar-internal.h", "net/rxrpc/call_event.c", "net/rxrpc/call_object.c", "net/rxrpc/conn_client.c", "net/rxrpc/input.c", "net/rxrpc/sendmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix ACKALL packet handling\n\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\ncall is in a state that can legitimately have outstanding transmit buffers.\nA forged ACKALL can therefore reach a new service call in\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\n\nIn that state call->tx_top is zero and call->tx_queue is NULL, so\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\nnull-pointer dereference.\n\nFix the handling of ACKALL packets by the following means:\n\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\n that the client call is connected, but nothing has been transmitted as\n yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\n has been transmitted at least once, but we're now waiting for the\n stuff remaining in the Tx buffer to be ACK'd (retransmissions may\n still happen).\n\n The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\n a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\n first packet is transmitted.\n\n RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\n that all Tx packets have been ACK'd and we're now waiting for the\n reply to be received.\n\n (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks\n that the call state is one in which there might be stuff in the Tx\n buffer to ACK, but now this includes AWAIT_ACK rather than\n AWAIT_REPLY. ACKALL packets are ignored if received in the wrong\n state.\n\n Note that unlike Wyatt Feng's patch, it's no longer necessary to check\n to see if the Tx buffer exists as this the state set now covers this.\n\n (3) Make the ACKALL handler use call->tx_transmitted rather than\n call->tx_top as the former is explicitly the highest packet seq number\n transmitted, whereas the latter has a looser definition.\n\nThanks to Jeffrey Altman for a description of the history of the ACKALL\npacket[1]."}], "id": "CVE-2026-74430", "lastModified": "2026-08-17T06:19:38.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:45.120", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: rxrpc: Fix ACKALL packet handling", "id": "2516872", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516872"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's rxrpc component. A remote attacker could send a specially crafted ACKALL packet that bypasses state validation. This improper handling of forged packets can lead to a null-pointer dereference, causing a Denial of Service (DoS) by crashing the system."], "name": "CVE-2026-74430", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74430\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74430\nhttps://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-74430-e0c4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b341a0263b1b804d329f864c2dc24815364510ec,8db6a2c95e36938076b37466ce36774526a5c8c3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b341a0263b1b804d329f864c2dc24815364510ec,523cb585672ae681b2d3b0d620aec5313774e2e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b341a0263b1b804d329f864c2dc24815364510ec,9b6ce594808580b2a19e6e1aa459ef56c0153ac1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:45:03.196889+00:00", "updated": "2026-08-21T22:15:04.723948+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}