SB2026081508 - Improper input validation in Linux kernel rxrpc

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-74429)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the rxrpc reply handling logic when processing an apparent reply DATA packet before any request DATA packets have been sent on a client call. A remote attacker can send a specially crafted early reply packet to cause a denial of service.

The issue can lead to a kernel oops when a client call has not yet been exposed by transmission of the first packet.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/a58e33405acd2584e730c1da72635f822ada6b49
• https://git.kernel.org/stable/c/e220ae559e5a0fc33e41ec6a348ea50387cb8b0f
• https://git.kernel.org/stable/c/f9be514984471ff0003738b2e1efed12bc3433ff