CVE-2026-74434

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rxrpc recvmsg oob() function where out-of-band (OOB) messages are handled incorrectly when using the MSG PEEK flag. While the unlink operation from recvmsg oobq is guarded by MSG PEEK, the subsequent move to the pending oobq tree is not. This causes a socket buffer (skb) to be present in both queues simultaneously. Because the rbnode in struct sk buff shares storage with list pointers, the rb insert color() function overwrites the list linkage. When the socket closes and queues are drained, skb unlink() attempts to follow these corrupted pointers, leading to memory corruption. Additionally, since the skb is freed from both queues despite having only one reference, it results in a use-after-free condition due to a connection refcount underflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.