Linux Kernel CVE-2026-74430

Exploitation requires the target Linux system to be running an rxrpc service actively listening for inbound connections - this is not a default configuration in mainstream distributions and is primarily associated with AFS server deployments. The attacker must be able to reach the rxrpc UDP port (commonly 7001) at the network level. The vulnerable kernel state (RXRPC_CALL_SERVER_RECV_REQUEST with NULL tx_queue) is a natural transient window at the start of any incoming service call, so no special timing or race condition manipulation is needed beyond targeting an active server. Authentication is not required per CVSS PR:N. Exploitation is limited by: (1) the rxrpc subsystem not being enabled or exposed in most Linux deployments; (2) the target must have an active service call in the vulnerable state at the moment the forged packet arrives (a brief but normally recurring window during legitimate AFS operations); (3) no authentication bypass is involved - this is not a post-auth vulnerability, but the prerequisite of an exposed rxrpc service substantially reduces the realistic population of affected systems.

The CVSS 7.5 score reflects a technically accurate network-accessible, unauthenticated Denial of Service path, but multiple intelligence signals substantially narrow real-world risk. EPSS probability of 0.15% at the 5th percentile is consistent with a kernel subsystem flaw requiring niche protocol exposure rather than broad automated exploitation; even a mid-sized municipal IT team in leszno would only be affected if their infrastructure actively serves AFS over rxrpc, which is uncommon in general-purpose deployments. RxRPC is not enabled or exposed by default in the vast majority of Linux distributions - it is a specialized transport primarily used for AFS - meaning the effective attack surface is far smaller than the AV:N/AC:L/PR:N CVSS vector implies in isolation. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and SSVC signals point to medium operational priority: exploitation status none, automatable yes against exposed endpoints, technical impact partial (kernel crash only, no privilege escalation or data exfiltration). One notable data quality issue: the EUVD tags this entry as 'Information Disclosure,' which directly contradicts both the CVE description and the CVSS vector (C:N/I:N/A:H); the actual impact is purely availability. The CVSS score is an accurate ceiling for the worst case but should not drive prioritization absent confirmed rxrpc exposure.

An unauthenticated remote attacker identifies a Linux system running an rxrpc service, such as an AFS file server, and sends a crafted ACKALL control packet over UDP targeting an active service call that is in the early RXRPC_CALL_SERVER_RECV_REQUEST state before any reply has been dispatched. The kernel processes the packet without validating call state, passes execution to rxrpc_rotate_tx_window() with a NULL tx_queue pointer, and crashes. No public exploit code has been identified, but the attack requires only the ability to reach the rxrpc UDP port and send a single malformed packet.