CVE-2026-74434

A flaw was found in the Linux kernel's rxrpc subsystem. When an out-of-band (OOB) message is read using the MSG_PEEK flag in the rxrpc_recvmsg_oob() function, the message is incorrectly left on one queue while also being added to another. This can lead to the message being freed twice when the socket is closed, resulting in memory corruption and a use-after-free vulnerability. A local attacker could exploit this to cause system instability or potentially execute arbitrary code.

This vulnerability is rated as Important severity because local unprivileged attackers can trigger memory corruption and potential privilege escalation through socket manipulation. The RxRPC protocol is not utilized in standard environments by default and requires the loading of the corresponding kernel module. Furthermore, earlier platforms such as Red Hat Enterprise Linux 8 and 9 do not contain the vulnerable code introduced in upstream kernel version 6.16.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.