CVE-2026-74428

A flaw was found in the Linux kernel's rxrpc subsystem. A double unlock vulnerability in the rxrpc_recvmsg() function, when processing out-of-band (OOB) messages, could allow a remote attacker to cause a system crash. This issue leads to a Denial of Service (DoS) condition.

This vulnerability is rated as Moderate impact because an authenticated local user can trigger a denial of service through a kernel panic, without compromising system confidentiality or integrity. Exploitation requires interaction with the AF_RXRPC network socket interface, which is rarely utilized in standard enterprise server environments unless AFS networking is configured. The problematic code is not present in Red Hat Enterprise Linux 8 and 9, limiting exposure to environments running newer kernel streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.