CVE-2026-74435

A flaw was found in the rxrpc subsystem of the Linux kernel. This vulnerability occurs when the rxrpc_verify_data function fails to allocate a necessary buffer if the incoming data length is zero. An attacker could exploit this by sending specially crafted network packets, leading to a NULL pointer dereference and potentially causing a system crash, resulting in a denial of service.

An RxRPC receive path NULL pointer dereference can occur because rxrpc_verify_data() may return success without allocating rxrpc_call.rx_dec_buffer when the received skb data length is zero. A remote peer can then drive rxrpc_recvmsg_data() into a later skb_copy_bits() call with a NULL destination, causing a kernel crash and denial of service. For the CVSS the PR:N is used because the vulnerable receive path can be reached by a network peer without local code execution when an RxRPC or AFS endpoint is exposed. The issue is network reachable over RxRPC deployments and does not require user interaction. Impact is denial of service only based on the visible primitive, because this is a NULL pointer dereference rather than a demonstrated UAF, OOB write, or information leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.