CVE-2026-74429

A flaw was found in the Linux kernel's rxrpc component. This vulnerability occurs when the system receives a reply data packet before any request data packets have been sent on a client call. An attacker could potentially exploit this by sending a specially crafted reply packet, leading to a kernel panic or system crash. This could result in a Denial of Service (DoS) for the affected system.

This vulnerability is assessed as Moderate severity because the rxrpc module is not loaded by default on typical Red Hat installations and requires explicit use of RxRPC-based networking, such as AFS file sharing, to expose the affected code path. While an unexpected packet received prior to client transmission can trigger a kernel oops, the blast radius is restricted to a denial of service (system crash) without compromising system confidentiality or integrity. Systems that do not actively communicate over AF_RXRPC sockets are not exposed to this flaw during standard operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.