{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23066", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.954Z", "datePublished": "2026-02-04T16:07:47.764Z", "dateUpdated": "2026-08-05T12:20:10.968Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:10.968Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recvmsg() unconditional requeue\n\nIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at\nthe front of the recvmsg queue already has its mutex locked, it requeues\nthe call - whether or not the call is already queued. The call may be on\nthe queue because MSG_PEEK was also passed and so the call was not dequeued\nor because the I/O thread requeued it.\n\nThe unconditional requeue may then corrupt the recvmsg queue, leading to\nthings like UAFs or refcount underruns.\n\nFix this by only requeuing the call if it isn't already on the queue - and\nmoving it to the front if it is already queued. If we don't queue it, we\nhave to put the ref we obtained by dequeuing it.\n\nAlso, MSG_PEEK doesn't dequeue the call so shouldn't call\nrxrpc_notify_socket() for the call if we didn't use up all the data on the\nqueue, so fix that also." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered via the recvmsg() syscall on a local AF_RXRPC socket. The attacker must create a local socket and call recvmsg() with specific flags (MSG_DONTWAIT, MSG_PEEK).\nAC:L - The attacker controls both sides of the race condition — they can have one thread hold the call's user_mutex while another thread calls recvmsg() with MSG_DONTWAIT, reliably triggering the unconditional requeue and list corruption.\nPR:L - No capability checks exist in rxrpc_create(). Any unprivileged local user can create an AF_RXRPC socket and trigger the bug through recvmsg() with specific flags.\nUI:N - No user interaction is required. The attacker can trigger the vulnerability entirely on their own by opening a socket and calling recvmsg() from multiple threads.\nS:U - The vulnerability affects the kernel within the same security authority. No security boundary (VM, sandbox) is crossed.\nC:H - The use-after-free allows reading freed and potentially reallocated memory, providing arbitrary memory read primitives through heap spraying techniques.\nI:H - The use-after-free and list corruption allow arbitrary write primitives via heap spraying, enabling control flow hijacking and arbitrary code execution in kernel context.\nA:H - List corruption and use-after-free reliably cause kernel crashes (oops/panic), and refcount underruns lead to premature object destruction causing further crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/rxrpc.h", "net/rxrpc/recvmsg.c" ], "versions": [ { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "8fd3b5e297854a4da0f273169baf4b1b7b257b97", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "c198628f3fca5c874d93874c233014d336e09f64", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "c6cebcb4e0b3140ec2ace45c020a9049527385d1", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "0464bf75590da75b8413c3e758c04647b4cdb3c6", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "cf969bddd6e69c5777fa89dc88402204e72f312a", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "930114425065f7ace6e0c0630fab4af75e059ea8", "status": "affected", "versionType": "git" }, { "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be", "lessThan": "2c28769a51deb6022d7fbd499987e237a01dd63a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/rxrpc.h", "net/rxrpc/recvmsg.c" ], "versions": [ { "version": "4.11", "status": "affected" }, { "version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97" }, { "url": "https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64" }, { "url": "https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1" }, { "url": "https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6" }, { "url": "https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a" }, { "url": "https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8" }, { "url": "https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a" } ], "title": "rxrpc: Fix recvmsg() unconditional requeue", "x_generator": { "engine": "bippy-1.2.0" } } } }