CVE-2026-74429 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the reception of a reply packet before data transmission
Fix rxrpc_receiving_reply() to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call by checking to see if the call has been exposed yet by sending the first packet.
Without this, rxrpc_rotate_tx_window() might oops.
Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by changing the do...while loop into a while loop, just in case a call is abnormally terminated by an early reply before the last request packet is transmitted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability addressed in this linux kernel patch relates to a race condition and improper state handling within the rxrpc subsystem, which is responsible for handling remote execution rpc communications. This flaw specifically affects client-side operations where the kernel must manage the transmission and reception of data packets across network connections. The issue manifests when a client receives what appears to be a reply DATA packet before the system has had an opportunity to send any request DATA packets, creating a scenario where the kernel's internal state management becomes inconsistent.
The technical root cause involves the rxrpc_receiving_reply() function which fails to properly verify whether a call has been initialized or exposed before processing incoming reply packets. When a client receives an early reply packet, the system attempts to call rxrpc_rotate_tx_window() without ensuring that the transmission window rotation logic has appropriate context about the call's current state. This leads to potential null pointer dereferences or invalid memory accesses that result in kernel oops messages and system instability.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, as it represents a fundamental flaw in the kernel's packet processing pipeline that could potentially be exploited by malicious actors to cause system crashes or, in more sophisticated attack scenarios, gain unauthorized access to kernel memory spaces. The vulnerability affects any system running linux kernels with rxrpc support, particularly those handling remote procedure calls over network connections where client-server communication patterns may encounter early reply packets.
The fix implements two critical changes to address the vulnerability. First, the rxrpc_receiving_reply() function now includes a check to determine if the call has been properly exposed before processing incoming reply packets, ensuring that the system only handles responses for calls that have actually initiated transmission. Second, the rxrpc_rotate_tx_window() function was modified to handle empty transmission queues by converting a do...while loop structure into a standard while loop, preventing potential infinite loops or improper state transitions when calls are terminated prematurely due to early replies.
This vulnerability aligns with CWE-362, which addresses race conditions in concurrent systems, and demonstrates the importance of proper synchronization and state validation in kernel-level network protocols. The fix pattern follows established security practices for preventing invalid memory access patterns and maintaining system stability under concurrent operation scenarios. From an attacker perspective, this vulnerability could potentially map to ATT&CK technique T1059 where system crashes might be used as part of broader exploitation strategies, though the primary risk remains system instability rather than direct privilege escalation.
The patch ensures that kernel networking operations maintain proper state consistency even when encountering unexpected packet ordering or timing conditions, which is critical for maintaining network reliability in enterprise environments where kernel stability directly impacts service availability. The solution demonstrates good defensive programming practices by validating preconditions before executing complex state management operations and handling edge cases that might occur during abnormal termination scenarios.
This fix contributes to the overall security posture of linux systems by preventing potential denial of service conditions and maintaining kernel memory integrity during network protocol processing, particularly in environments where rpc communications are heavily utilized for distributed application architectures. The implementation follows kernel development best practices for maintaining robust state management in concurrent network processing contexts while ensuring proper resource cleanup and error handling throughout the packet reception lifecycle.