EUVD-2026-59578
GHSA-pvqf-593m-79fg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote attacker sends packets over network without authentication; sole impact is availability via infinite loop in recvmsg wait condition.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
Fix the wait in rxrpc_recvmsg() also take check the oob queue.
AnalysisAI
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must have the rxrpc kernel subsystem actively loaded and in use - this primarily means hosts running AFS (Andrew File System) clients (e.g., OpenAFS kAFS) or AFS servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly classifies this as a remotely triggerable, unauthenticated DoS with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with network access to a host running an rxrpc endpoint sends a sequence of crafted RxRPC packets designed to enqueue data into the kernel's OOB queue for an rxrpc socket. When the victim process calls recvmsg() and enters the wait loop in rxrpc_recvmsg(), the loop evaluates a condition that does not inspect the OOB queue, causing it to spin indefinitely rather than waking to deliver the queued data. … |
| Remediation | Upgrade to Linux 6.18.40 or 7.1.5 (or later), which contain the rxrpc_recvmsg() OOB queue wait-condition fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux with RxRPC endpoints (primarily AFS clients and servers on systems running Linux through version 7.1.4 or 6.18.39) and assess their exposure using standard vulnerability scanning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today