CVE-2026-74436

A flaw was found in the Linux kernel. A synchronization issue in the rxrpc component, specifically between rxrpc_kernel_charge_accept() and rxrpc_discard_prealloc(), can lead to a use-after-free vulnerability. A local attacker could potentially exploit this flaw, causing a kernel preallocation worker to access freed memory. This could result in system instability or a denial of service (DoS).

rxrpc_kernel_charge_accept read rx backlog without socket or backlog synchronization while concurrent teardown could clear rx backlog and free the backlog rings. A preallocation worker could then keep using a freed rxrpc_backlog object while updating backlog head and tail fields and array slots, which makes this a use after free candidate rather than a pure crash only bug. For the CVSS the PR:L is used because reliable triggering likely requires a local or delegated actor able to influence rxrpc service socket teardown or kernel service lifecycle, while network traffic may help hit the race. The issue is not proven to be directly network reachable as a standalone remote attack, but rxrpc is a network protocol and incoming service traffic can be part of the vulnerable timing window. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.