GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74430 (GCVE-0-2026-74430)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:47
VLAI
Title
rxrpc: Fix ACKALL packet handling
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc_input_ackall() accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service call in RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued. In that state call->tx_top is zero and call->tx_queue is NULL, so rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a null-pointer dereference. Fix the handling of ACKALL packets by the following means: (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates that the client call is connected, but nothing has been transmitted as yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything has been transmitted at least once, but we're now waiting for the stuff remaining in the Tx buffer to be ACK'd (retransmissions may still happen). The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the first packet is transmitted. RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate that all Tx packets have been ACK'd and we're now waiting for the reply to be received. (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks that the call state is one in which there might be stuff in the Tx buffer to ACK, but now this includes AWAIT_ACK rather than AWAIT_REPLY. ACKALL packets are ignored if received in the wrong state. Note that unlike Wyatt Feng's patch, it's no longer necessary to check to see if the Tx buffer exists as this the state set now covers this. (3) Make the ACKALL handler use call->tx_transmitted rather than call->tx_top as the former is explicitly the highest packet seq number transmitted, whereas the latter has a looser definition. Thanks to Jeffrey Altman for a description of the history of the ACKALL packet[1].
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 8db6a2c95e36938076b37466ce36774526a5c8c3 (git)
Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 523cb585672ae681b2d3b0d620aec5313774e2e2 (git)
Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8db6a2c95e36938076b37466ce36774526a5c8c3",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "523cb585672ae681b2d3b0d620aec5313774e2e2",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "9b6ce594808580b2a19e6e1aa459ef56c0153ac1",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix ACKALL packet handling\n\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\ncall is in a state that can legitimately have outstanding transmit buffers.\nA forged ACKALL can therefore reach a new service call in\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\n\nIn that state call-\u003etx_top is zero and call-\u003etx_queue is NULL, so\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\nnull-pointer dereference.\n\nFix the handling of ACKALL packets by the following means:\n\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\n     that the client call is connected, but nothing has been transmitted as\n     yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\n     has been transmitted at least once, but we\u0027re now waiting for the\n     stuff remaining in the Tx buffer to be ACK\u0027d (retransmissions may\n     still happen).\n\n     The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\n     a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\n     first packet is transmitted.\n\n     RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\n     that all Tx packets have been ACK\u0027d and we\u0027re now waiting for the\n     reply to be received.\n\n (2) As per Wyatt Feng\u0027s original patch[1], the ACKALL handler then checks\n     that the call state is one in which there might be stuff in the Tx\n     buffer to ACK, but now this includes AWAIT_ACK rather than\n     AWAIT_REPLY.  ACKALL packets are ignored if received in the wrong\n     state.\n\n     Note that unlike Wyatt Feng\u0027s patch, it\u0027s no longer necessary to check\n     to see if the Tx buffer exists as this the state set now covers this.\n\n (3) Make the ACKALL handler use call-\u003etx_transmitted rather than\n     call-\u003etx_top as the former is explicitly the highest packet seq number\n     transmitted, whereas the latter has a looser definition.\n\nThanks to Jeffrey Altman for a description of the history of the ACKALL\npacket[1]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Forged ACKALL packets reach rxrpc_input_ackall() via UDP through rxrpc_encap_rcv() and the normal RxRPC receive path on internet-reachable AFS/AF_RXRPC servers without local access.\nAC:L - The attacker opens the call with DATA then immediately sends ACKALL while the server call is in RXRPC_CALL_SERVER_RECV_REQUEST, reliably triggering the NULL tx_queue dereference without races or special timing.\nPR:N - Only network access to an RxRPC listener is required; ACKALL is not cryptographically verified on input and the crash occurs on new service calls before reply transmission, including during pre-authentication connection setup.\nUI:N - No victim user action is required beyond a host running an affected RxRPC/AFS service; exploitation is accomplished entirely by attacker-crafted network packets.\nS:U - The vulnerability causes a kernel NULL-pointer dereference and crash within the RxRPC subsystem on the same host, not a cross-boundary escape such as VM guest-to-host or sandbox breakout.\nC:N - This is a pure NULL-pointer dereference with no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data to the attacker.\nI:N - No memory corruption or attacker-controlled writes occur; the fault path only dereferences a NULL tx_queue pointer and cannot be leveraged for arbitrary modification or code execution.\nA:H - A forged ACKALL in an invalid call state causes rxrpc_rotate_tx_window() to dereference NULL call-\u003etx_queue, producing a kernel oops or panic and denying availability of the RxRPC/AFS server and potentially the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:05.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1"
        }
      ],
      "title": "rxrpc: Fix ACKALL packet handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74430",
    "datePublished": "2026-08-15T05:59:30.965Z",
    "dateReserved": "2026-08-15T05:44:03.895Z",
    "dateUpdated": "2026-08-17T05:47:05.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74430",
      "date": "2026-09-05",
      "epss": "0.00339",
      "percentile": "0.2667"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74430\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:45.120\",\"lastModified\":\"2026-08-17T06:19:38.597\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix ACKALL packet handling\\n\\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\\ncall is in a state that can legitimately have outstanding transmit buffers.\\nA forged ACKALL can therefore reach a new service call in\\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\\n\\nIn that state call-\u003etx_top is zero and call-\u003etx_queue is NULL, so\\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\\nnull-pointer dereference.\\n\\nFix the handling of ACKALL packets by the following means:\\n\\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\\n     that the client call is connected, but nothing has been transmitted as\\n     yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\\n     has been transmitted at least once, but we\u0027re now waiting for the\\n     stuff remaining in the Tx buffer to be ACK\u0027d (retransmissions may\\n     still happen).\\n\\n     The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\\n     a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\\n     first packet is transmitted.\\n\\n     RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\\n     that all Tx packets have been ACK\u0027d and we\u0027re now waiting for the\\n     reply to be received.\\n\\n (2) As per Wyatt Feng\u0027s original patch[1], the ACKALL handler then checks\\n     that the call state is one in which there might be stuff in the Tx\\n     buffer to ACK, but now this includes AWAIT_ACK rather than\\n     AWAIT_REPLY.  ACKALL packets are ignored if received in the wrong\\n     state.\\n\\n     Note that unlike Wyatt Feng\u0027s patch, it\u0027s no longer necessary to check\\n     to see if the Tx buffer exists as this the state set now covers this.\\n\\n (3) Make the ACKALL handler use call-\u003etx_transmitted rather than\\n     call-\u003etx_top as the former is explicitly the highest packet seq number\\n     transmitted, whereas the latter has a looser definition.\\n\\nThanks to Jeffrey Altman for a description of the history of the ACKALL\\npacket[1].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/call_event.c\",\"net/rxrpc/call_object.c\",\"net/rxrpc/conn_client.c\",\"net/rxrpc/input.c\",\"net/rxrpc/sendmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b341a0263b1b804d329f864c2dc24815364510ec\",\"lessThan\":\"8db6a2c95e36938076b37466ce36774526a5c8c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b341a0263b1b804d329f864c2dc24815364510ec\",\"lessThan\":\"523cb585672ae681b2d3b0d620aec5313774e2e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b341a0263b1b804d329f864c2dc24815364510ec\",\"lessThan\":\"9b6ce594808580b2a19e6e1aa459ef56c0153ac1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/call_event.c\",\"net/rxrpc/call_object.c\",\"net/rxrpc/conn_client.c\",\"net/rxrpc/input.c\",\"net/rxrpc/sendmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:37:58+00:00",
      "cve": "CVE-2026-74430",
      "id": "CVE-2026-74430",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: Fix ACKALL packet handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74430.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.