Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system resource leak. This occurs in the RxRPC protocol implementation, which is used for certain types of network communications. If exploited, this could lead to a denial-of-service condition where the system becomes unstable or crashes due to exhausted resources.
Technical details
A reference count leak exists in the rxrpc_server_keyring() function within the AF_RXRPC implementation of the Linux kernel. The vulnerability is caused by a failure to check if the 'rx->securities' pointer is already set before proceeding with operations that increment reference counts. A local attacker with low privileges can trigger this leak by repeatedly making specific socket-related calls. Over time, this results in a kernel memory leak or reference count overflow, leading to a denial-of-service (DoS). The issue has been patched across multiple stable kernel branches by adding a check for the existing state of 'rx->securities'.
Affected products
- Linux Linux Kernel 2.6.22 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-18: patched: Patched in various stable branches via commits 12de9e0, 139c750, etc.
References
- https://git.kernel.org/stable/c/12de9e0e0b0b7058be7dfb8a5927eb565bc25780
- https://git.kernel.org/stable/c/139c750bf06649097d98b0bc41e2a678b4627e27
- https://git.kernel.org/stable/c/45d9584e51bdd61faf1900f82666d4ea6a85da72
- https://git.kernel.org/stable/c/8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a
- https://git.kernel.org/stable/c/9ce36d28f67c2a477a7e2f03480de3f6783fb363
- https://git.kernel.org/stable/c/c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2
- https://git.kernel.org/stable/c/f125846ee79fcae537a964ce66494e96fa54a6de