GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23066 (GCVE-0-2026-23066)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:07 – Updated: 2026-08-05 12:20
VLAI
Title
rxrpc: Fix recvmsg() unconditional requeue
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it. The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns. Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it. Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < 8fd3b5e297854a4da0f273169baf4b1b7b257b97 (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < c198628f3fca5c874d93874c233014d336e09f64 (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < c6cebcb4e0b3140ec2ace45c020a9049527385d1 (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < 0464bf75590da75b8413c3e758c04647b4cdb3c6 (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < cf969bddd6e69c5777fa89dc88402204e72f312a (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < 930114425065f7ace6e0c0630fab4af75e059ea8 (git)
Affected: 540b1c48c37ac0ad66212004db21e1ff7e2d78be , < 2c28769a51deb6022d7fbd499987e237a01dd63a (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fd3b5e297854a4da0f273169baf4b1b7b257b97",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "c198628f3fca5c874d93874c233014d336e09f64",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "c6cebcb4e0b3140ec2ace45c020a9049527385d1",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "0464bf75590da75b8413c3e758c04647b4cdb3c6",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "cf969bddd6e69c5777fa89dc88402204e72f312a",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "930114425065f7ace6e0c0630fab4af75e059ea8",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "2c28769a51deb6022d7fbd499987e237a01dd63a",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recvmsg() unconditional requeue\n\nIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at\nthe front of the recvmsg queue already has its mutex locked, it requeues\nthe call - whether or not the call is already queued.  The call may be on\nthe queue because MSG_PEEK was also passed and so the call was not dequeued\nor because the I/O thread requeued it.\n\nThe unconditional requeue may then corrupt the recvmsg queue, leading to\nthings like UAFs or refcount underruns.\n\nFix this by only requeuing the call if it isn\u0027t already on the queue - and\nmoving it to the front if it is already queued.  If we don\u0027t queue it, we\nhave to put the ref we obtained by dequeuing it.\n\nAlso, MSG_PEEK doesn\u0027t dequeue the call so shouldn\u0027t call\nrxrpc_notify_socket() for the call if we didn\u0027t use up all the data on the\nqueue, so fix that also."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered via the recvmsg() syscall on a local AF_RXRPC socket. The attacker must create a local socket and call recvmsg() with specific flags (MSG_DONTWAIT, MSG_PEEK).\nAC:L - The attacker controls both sides of the race condition \u2014 they can have one thread hold the call\u0027s user_mutex while another thread calls recvmsg() with MSG_DONTWAIT, reliably triggering the unconditional requeue and list corruption.\nPR:L - No capability checks exist in rxrpc_create(). Any unprivileged local user can create an AF_RXRPC socket and trigger the bug through recvmsg() with specific flags.\nUI:N - No user interaction is required. The attacker can trigger the vulnerability entirely on their own by opening a socket and calling recvmsg() from multiple threads.\nS:U - The vulnerability affects the kernel within the same security authority. No security boundary (VM, sandbox) is crossed.\nC:H - The use-after-free allows reading freed and potentially reallocated memory, providing arbitrary memory read primitives through heap spraying techniques.\nI:H - The use-after-free and list corruption allow arbitrary write primitives via heap spraying, enabling control flow hijacking and arbitrary code execution in kernel context.\nA:H - List corruption and use-after-free reliably cause kernel crashes (oops/panic), and refcount underruns lead to premature object destruction causing further crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:10.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97"
        },
        {
          "url": "https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a"
        },
        {
          "url": "https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a"
        }
      ],
      "title": "rxrpc: Fix recvmsg() unconditional requeue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23066",
    "datePublished": "2026-02-04T16:07:47.764Z",
    "dateReserved": "2026-01-13T15:37:45.954Z",
    "dateUpdated": "2026-08-05T12:20:10.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23066",
      "date": "2026-09-18",
      "epss": "0.00134",
      "percentile": "0.03296"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:44:50.000Z",
      "cve": "CVE-2026-23066",
      "id": "msrc_CVE-2026-23066",
      "initial_release_date": "2026-02-02T00:00:00.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rxrpc: Fix recvmsg() unconditional requeue",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23066.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/trace/events/rxrpc.h",
                  "net/rxrpc/recvmsg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8fd3b5e297854a4da0f273169baf4b1b7b257b97",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c198628f3fca5c874d93874c233014d336e09f64",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c6cebcb4e0b3140ec2ace45c020a9049527385d1",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0464bf75590da75b8413c3e758c04647b4cdb3c6",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cf969bddd6e69c5777fa89dc88402204e72f312a",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "930114425065f7ace6e0c0630fab4af75e059ea8",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c28769a51deb6022d7fbd499987e237a01dd63a",
                    "status": "affected",
                    "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/trace/events/rxrpc.h",
                  "net/rxrpc/recvmsg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.78",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A85A6630-48F5-47FB-9871-DB4D2269F664",
                    "versionEndExcluding": "6.18.8",
                    "versionStartIncluding": "4.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recvmsg() unconditional requeue\n\nIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at\nthe front of the recvmsg queue already has its mutex locked, it requeues\nthe call - whether or not the call is already queued.  The call may be on\nthe queue because MSG_PEEK was also passed and so the call was not dequeued\nor because the I/O thread requeued it.\n\nThe unconditional requeue may then corrupt the recvmsg queue, leading to\nthings like UAFs or refcount underruns.\n\nFix this by only requeuing the call if it isn\u0027t already on the queue - and\nmoving it to the front if it is already queued.  If we don\u0027t queue it, we\nhave to put the ref we obtained by dequeuing it.\n\nAlso, MSG_PEEK doesn\u0027t dequeue the call so shouldn\u0027t call\nrxrpc_notify_socket() for the call if we didn\u0027t use up all the data on the\nqueue, so fix that also."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Correcci\u00f3n del reenqueque incondicional de recvmsg()\n\nSi rxrpc_recvmsg() falla porque se especific\u00f3 MSG_DONTWAIT pero la llamada al frente de la cola de recvmsg ya tiene su mutex bloqueado, reenquequea la llamada, est\u00e9 o no la llamada ya en la cola. La llamada puede estar en la cola porque tambi\u00e9n se pas\u00f3 MSG_PEEK y por lo tanto la llamada no fue desencolada o porque el hilo de E/S la reenqueque\u00f3.\n\nEl reenqueque incondicional puede entonces corromper la cola de recvmsg, lo que lleva a cosas como UAFs o subdesbordamientos de refcount.\n\nSolucione esto reenquequeando la llamada solo si no est\u00e1 ya en la cola, y movi\u00e9ndola al frente si ya est\u00e1 en la cola. Si no la encolamos, tenemos que liberar la referencia que obtuvimos al desencolarla.\n\nAdem\u00e1s, MSG_PEEK no desencola la llamada, por lo que no deber\u00eda llamar a rxrpc_notify_socket() para la llamada si no consumimos todos los datos de la cola, as\u00ed que corrija eso tambi\u00e9n."
          }
        ],
        "id": "CVE-2026-23066",
        "lastModified": "2026-06-17T10:20:48.143",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-02-04T17:16:17.303",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-12T07:55:10+00:00",
      "cve": "CVE-2026-23066",
      "id": "CVE-2026-23066",
      "initial_release_date": "2026-02-04T00:00:00+00:00",
      "product_status:fixed": "1092",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "75",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23066.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.