Linux Kernel CVE-2026-74431

The target system must have the rxrpc kernel subsystem actively loaded and in use - this primarily means hosts running AFS (Andrew File System) clients (e.g., OpenAFS kAFS) or AFS servers. Systems that do not use rxrpc are entirely unaffected regardless of kernel version. The kernel version must fall between the introducing commit (5800b1cf3fd8ccab752a101865be1e76dac33142) and the branch-specific fix commits; kernels already at 6.18.40, 7.1.5, or 7.2-rc1 are not vulnerable. The attacker must have network connectivity to the rxrpc UDP port (default 7001) on the target. Key limiting factors are: rxrpc is not a default or widely-loaded subsystem; AFS infrastructure is required for exposure; and the CVSS PR:N condition applies only to the remote attacker's perspective - the attack requires the victim host to be actively running rxrpc services.

The CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly classifies this as a remotely triggerable, unauthenticated DoS with high availability impact. However, real-world priority should be substantially discounted for most organizations. EPSS at 0.15% (5th percentile) reflects near-zero exploitation probability, consistent with the absence of a CISA KEV listing and no identified public exploit code. The critical limiting factor is the narrow deployment base: rxrpc is a niche subsystem not loaded or exposed on the vast majority of Linux systems - only AFS clients, AFS servers, and related Kerberos infrastructure are practically at risk. SSVC signals reinforce low urgency: no known active exploitation, low automation potential due to the specialized target population, and technical impact confined entirely to availability. This is a genuine priority for AFS infrastructure operators; for general-purpose Linux deployments, the effective risk is minimal.

A remote attacker with network access to a host running an rxrpc endpoint sends a sequence of crafted RxRPC packets designed to enqueue data into the kernel's OOB queue for an rxrpc socket. When the victim process calls recvmsg() and enters the wait loop in rxrpc_recvmsg(), the loop evaluates a condition that does not inspect the OOB queue, causing it to spin indefinitely rather than waking to deliver the queued data. The affected kernel thread or userspace process hangs permanently, rendering rxrpc and any dependent AFS services unavailable. No public proof-of-concept exploit has been identified at the time of analysis.