CVE-2026-74435

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where rxrpc recvmsg data() calls rxrpc verify data() when rxrpc call.rx dec buffer is unallocated, assuming it will be allocated upon a successful return. However, rxrpc verify data() fails to request an allocation if rxrpc skb priv.len is zero. Furthermore, a failure to allocate rx dec buffer leads to skb copy bits() being called with a NULL destination, which can trigger a NULL pointer dereference, a condition where the system attempts to read or write to a memory address that is null, typically resulting in a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.