CVE-2026-74435 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
A missing buffer allocation in the Linux kernel's rxrpc module can cause a NULL pointer dereference, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74435?
CVE-2026-74435 is a high-severity vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verify_data() does not request an allocation if the rxrpc_skb_priv.len is zero.
In addition, failure to allocate rx_dec_buffer will result in a call to skb_copy_bits() with a NULL destination which can trigger a NULL pointer dereference.
To prevent these issues rxrpc_verify_data() is modified to always attempt to allocate the rxrpc_call.rx_dec_buffer if it is NULL.
This issue was identified with assistance of a private sashiko instance.
Which versions are affected by CVE-2026-74435?
How do I fix CVE-2026-74435?
Apply the vendor's patch.
Is CVE-2026-74435 being exploited?
There is no known exploitation of CVE-2026-74435 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74435, DEBIAN-CVE-2026-74435, GHSA-5hch-wgmx-fjg3, UBUNTU-CVE-2026-74435.