CVE-2026-74436 rxrpc: serialize kernel accept preallocation with socket teardown
A race condition in the Linux kernel's rxrpc module allows use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74436?
CVE-2026-74436 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: serialize kernel accept preallocation with socket teardown
rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots.
Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.
Which versions are affected by CVE-2026-74436?
How do I fix CVE-2026-74436?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74436 being exploited?
There is no known exploitation of CVE-2026-74436 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74436, DEBIAN-CVE-2026-74436, GHSA-c43x-9gq9-q65m, UBUNTU-CVE-2026-74436.