Vulnerability-Lookup

FKIE_CVE-2026-74430

Vulnerability from fkie_nvd - Published: 2026-08-15 06:22 - Updated: 2026-08-17 06:19

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc_input_ackall() accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service call in RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued. In that state call->tx_top is zero and call->tx_queue is NULL, so rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a null-pointer dereference. Fix the handling of ACKALL packets by the following means: (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates that the client call is connected, but nothing has been transmitted as yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything has been transmitted at least once, but we're now waiting for the stuff remaining in the Tx buffer to be ACK'd (retransmissions may still happen). The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the first packet is transmitted. RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate that all Tx packets have been ACK'd and we're now waiting for the reply to be received. (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks that the call state is one in which there might be stuff in the Tx buffer to ACK, but now this includes AWAIT_ACK rather than AWAIT_REPLY. ACKALL packets are ignored if received in the wrong state. Note that unlike Wyatt Feng's patch, it's no longer necessary to check to see if the Tx buffer exists as this the state set now covers this. (3) Make the ACKALL handler use call->tx_transmitted rather than call->tx_top as the former is explicitly the highest packet seq number transmitted, whereas the latter has a looser definition. Thanks to Jeffrey Altman for a description of the history of the ACKALL packet[1].

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8db6a2c95e36938076b37466ce36774526a5c8c3",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "523cb585672ae681b2d3b0d620aec5313774e2e2",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "9b6ce594808580b2a19e6e1aa459ef56c0153ac1",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix ACKALL packet handling\n\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\ncall is in a state that can legitimately have outstanding transmit buffers.\nA forged ACKALL can therefore reach a new service call in\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\n\nIn that state call-\u003etx_top is zero and call-\u003etx_queue is NULL, so\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\nnull-pointer dereference.\n\nFix the handling of ACKALL packets by the following means:\n\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\n     that the client call is connected, but nothing has been transmitted as\n     yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\n     has been transmitted at least once, but we\u0027re now waiting for the\n     stuff remaining in the Tx buffer to be ACK\u0027d (retransmissions may\n     still happen).\n\n     The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\n     a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\n     first packet is transmitted.\n\n     RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\n     that all Tx packets have been ACK\u0027d and we\u0027re now waiting for the\n     reply to be received.\n\n (2) As per Wyatt Feng\u0027s original patch[1], the ACKALL handler then checks\n     that the call state is one in which there might be stuff in the Tx\n     buffer to ACK, but now this includes AWAIT_ACK rather than\n     AWAIT_REPLY.  ACKALL packets are ignored if received in the wrong\n     state.\n\n     Note that unlike Wyatt Feng\u0027s patch, it\u0027s no longer necessary to check\n     to see if the Tx buffer exists as this the state set now covers this.\n\n (3) Make the ACKALL handler use call-\u003etx_transmitted rather than\n     call-\u003etx_top as the former is explicitly the highest packet seq number\n     transmitted, whereas the latter has a looser definition.\n\nThanks to Jeffrey Altman for a description of the history of the ACKALL\npacket[1]."
    }
  ],
  "id": "CVE-2026-74430",
  "lastModified": "2026-08-17T06:19:38.597",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:22:45.120",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-74430 (GCVE-0-2026-74430)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:47

Title

rxrpc: Fix ACKALL packet handling

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/8db6a2c95e3693807…
https://git.kernel.org/stable/c/523cb585672ae681b…
https://git.kernel.org/stable/c/9b6ce594808580b2a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 8db6a2c95e36938076b37466ce36774526a5c8c3 (git) Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 523cb585672ae681b2d3b0d620aec5313774e2e2 (git) Affected: b341a0263b1b804d329f864c2dc24815364510ec , < 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 (git)
Linux	Linux	Affected: 6.14 Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8db6a2c95e36938076b37466ce36774526a5c8c3",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "523cb585672ae681b2d3b0d620aec5313774e2e2",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            },
            {
              "lessThan": "9b6ce594808580b2a19e6e1aa459ef56c0153ac1",
              "status": "affected",
              "version": "b341a0263b1b804d329f864c2dc24815364510ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/call_object.c",
            "net/rxrpc/conn_client.c",
            "net/rxrpc/input.c",
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix ACKALL packet handling\n\nrxrpc_input_ackall() accepts ACKALL packets without checking whether the\ncall is in a state that can legitimately have outstanding transmit buffers.\nA forged ACKALL can therefore reach a new service call in\nRXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.\n\nIn that state call-\u003etx_top is zero and call-\u003etx_queue is NULL, so\nrxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a\nnull-pointer dereference.\n\nFix the handling of ACKALL packets by the following means:\n\n (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates\n     that the client call is connected, but nothing has been transmitted as\n     yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything\n     has been transmitted at least once, but we\u0027re now waiting for the\n     stuff remaining in the Tx buffer to be ACK\u0027d (retransmissions may\n     still happen).\n\n     The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned\n     a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the\n     first packet is transmitted.\n\n     RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate\n     that all Tx packets have been ACK\u0027d and we\u0027re now waiting for the\n     reply to be received.\n\n (2) As per Wyatt Feng\u0027s original patch[1], the ACKALL handler then checks\n     that the call state is one in which there might be stuff in the Tx\n     buffer to ACK, but now this includes AWAIT_ACK rather than\n     AWAIT_REPLY.  ACKALL packets are ignored if received in the wrong\n     state.\n\n     Note that unlike Wyatt Feng\u0027s patch, it\u0027s no longer necessary to check\n     to see if the Tx buffer exists as this the state set now covers this.\n\n (3) Make the ACKALL handler use call-\u003etx_transmitted rather than\n     call-\u003etx_top as the former is explicitly the highest packet seq number\n     transmitted, whereas the latter has a looser definition.\n\nThanks to Jeffrey Altman for a description of the history of the ACKALL\npacket[1]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Forged ACKALL packets reach rxrpc_input_ackall() via UDP through rxrpc_encap_rcv() and the normal RxRPC receive path on internet-reachable AFS/AF_RXRPC servers without local access.\nAC:L - The attacker opens the call with DATA then immediately sends ACKALL while the server call is in RXRPC_CALL_SERVER_RECV_REQUEST, reliably triggering the NULL tx_queue dereference without races or special timing.\nPR:N - Only network access to an RxRPC listener is required; ACKALL is not cryptographically verified on input and the crash occurs on new service calls before reply transmission, including during pre-authentication connection setup.\nUI:N - No victim user action is required beyond a host running an affected RxRPC/AFS service; exploitation is accomplished entirely by attacker-crafted network packets.\nS:U - The vulnerability causes a kernel NULL-pointer dereference and crash within the RxRPC subsystem on the same host, not a cross-boundary escape such as VM guest-to-host or sandbox breakout.\nC:N - This is a pure NULL-pointer dereference with no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data to the attacker.\nI:N - No memory corruption or attacker-controlled writes occur; the fault path only dereferences a NULL tx_queue pointer and cannot be leveraged for arbitrary modification or code execution.\nA:H - A forged ACKALL in an invalid call state causes rxrpc_rotate_tx_window() to dereference NULL call-\u003etx_queue, producing a kernel oops or panic and denying availability of the RxRPC/AFS server and potentially the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:05.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8db6a2c95e36938076b37466ce36774526a5c8c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/523cb585672ae681b2d3b0d620aec5313774e2e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b6ce594808580b2a19e6e1aa459ef56c0153ac1"
        }
      ],
      "title": "rxrpc: Fix ACKALL packet handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74430",
    "datePublished": "2026-08-15T05:59:30.965Z",
    "dateReserved": "2026-08-15T05:44:03.895Z",
    "dateUpdated": "2026-08-17T05:47:05.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-74430

CVE-2026-74430 (GCVE-0-2026-74430)

Tags

Sightings

Nomenclature