Linux Kernel CVE-2026-74435

The rxrpc kernel module must be loaded and an RxRPC protocol listener or AFS client must be actively running on the target system - this is a non-default configuration absent on the overwhelming majority of Linux deployments. The attacker must be able to send UDP packets to the system on the AFS/RxRPC port (UDP 7001 by default) and construct a packet whose rxrpc_skb_priv.len field evaluates to zero at the point rxrpc_verify_data() is called, while the rxrpc_call.rx_dec_buffer is currently unallocated (which occurs at the beginning of a receive sequence). Exploitation is limited to: systems with rxrpc/AFS actively in use, network reachability to RxRPC ports, and the race window where rx_dec_buffer is NULL. Systems without the rxrpc module loaded are completely unaffected regardless of other configuration.

CVSS 3.1 scores this 7.5 (High) with a fully network-exploitable vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting that the rxrpc socket interface is reachable from the network without authentication. However, real-world exploitability is substantially narrowed by a critical deployment constraint: the rxrpc module must be loaded and an active RxRPC listener or AFS client must be running; the vast majority of Linux servers and desktops never load this module. EPSS at 0.16% (5th percentile) independently confirms very low observed exploitation interest from the threat intelligence community, consistent with the niche nature of rxrpc. No public proof-of-concept has been identified and CISA KEV does not list this CVE, indicating no confirmed active exploitation. The CVSS availability impact of High is accurate - a successful trigger results in a kernel panic and immediate system unavailability - but the realistic attack surface is limited to systems actively using AFS or explicitly loading rxrpc. Priority should be high for AFS-dependent infrastructure but low to negligible for general-purpose Linux deployments.

An attacker reachable over the network sends a crafted RxRPC UDP datagram to a host running a Linux kernel with the rxrpc module loaded and an active AFS client, constructing the packet such that the skb private length field is zero. This triggers the early-exit path in rxrpc_verify_data(), which returns success without allocating rx_dec_buffer. The subsequent call to skb_copy_bits() with the NULL destination pointer causes a kernel NULL pointer dereference, crashing the system and denying service to all users. No public proof-of-concept has been identified at time of analysis.