Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially gain unauthorized access to data. The issue occurs in the AF_RXRPC protocol, which is used for certain types of network communications. An attacker could exploit this flaw to corrupt internal system memory, leading to unpredictable behavior or a complete system shutdown.
Technical details
A vulnerability exists in the rxrpc_recvmsg() function within the Linux kernel's AF_RXRPC implementation. When MSG_DONTWAIT is specified and a mutex is already locked, the kernel unconditionally requeues the call even if it is already present on the queue (e.g., due to a simultaneous MSG_PEEK or I/O thread activity). This unconditional requeue leads to corruption of the recvmsg queue, resulting in use-after-free (UAF) scenarios or reference count underruns. An attacker with local access can trigger this race condition to cause a denial of service or potentially escalate privileges. The issue has been patched in various stable branches including 5.10, 6.1, 6.6, and 6.12.
Affected products
- Linux Linux Kernel 4.11 to 6.18.8
Timeline
- 2026-02-04: disclosed: Initial publication of the vulnerability advisory
- 2026-02-04: advisory
- 2026-03-25: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6
- https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a
- https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97
- https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8
- https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64
- https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1
- https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a