Linux Kernel CVE-2026-74434

Requires local access to a host running an affected kernel (~6.16 through 7.1.4 / early 7.x) with AF_RXRPC support compiled in and the rxrpc module loaded, plus the ability to open an AF_RXRPC socket and receive an out-of-band challenge message. The specific trigger is calling recvmsg() with the MSG_PEEK flag on that OOB message and then closing the socket, so the queue is drained twice. Exploitation is limited by: the niche rxrpc/AFS code path (hosts without CONFIG_AF_RXRPC or without the OOB feature are unaffected), the requirement for local socket access rather than network reach despite the NVD AV:N vector, and the recency of the vulnerable feature (older LTS kernels do not contain it).

The signals conflict and should be weighed rather than taken at face value. NVD scores this 9.8 with an AV:N/AC:L/PR:N/UI:N vector, implying remote unauthenticated network exploitation, but the described trigger is a local process issuing recvmsg(MSG_PEEK) on an AF_RXRPC socket - that is local, not network-remote, so the AV:N is almost certainly an inflated auto-generated vector and real attack vector is local (verify against the vector-versus-description discrepancy before prioritizing). EPSS is low at 0.15% (5th percentile), the CVE is not on CISA KEV, and no public exploit is identified, which is consistent with a freshly-patched kernel bug rather than one under active exploitation. Practical exploitability is further limited because AF_RXRPC/OOB is a niche path (primarily AFS deployments) and only recent kernels (~6.16 onward) contain the vulnerable OOB feature. Net assessment: a genuine memory-corruption/UAF primitive worth patching promptly on affected kernels, especially multi-tenant or untrusted-local-user hosts where kernel LPE matters, but the raw 9.8 overstates the realistic risk for the typical fleet running older LTS kernels; even a mid-sized operator should schedule the stable-tree update, but this is not a drop-everything internet-facing emergency.

A local unprivileged user on an affected kernel opens an AF_RXRPC socket, receives an OOB challenge, and calls recvmsg with MSG_PEEK to leave the skb on recvmsg_oobq while it is also inserted into pending_oobq, then closes the socket so both queues are drained against the same singly-referenced skb. The resulting double-free and connection-refcount underflow corrupt kernel memory, which a skilled attacker could shape into local privilege escalation or use for denial of service; no public exploit is identified at time of analysis.