CVE-2026-74430

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the handling of ACKALL packets within the rxrpc module. The function rxrpc input ackall() accepts ACKALL packets without verifying if the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL packet can reach a new service call in the RXRPC CALL SERVER RECV REQUEST state before any reply packets are queued. In this scenario, the call->tx top variable is zero and call->tx queue is NULL, leading the rxrpc rotate tx window() function to dereference a NULL txqueue, which triggers a null-pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.