EUVD-2026-59575
GHSA-jr6m-prj2-3cff
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reached via local recvmsg() on an AF_RXRPC socket (AV:L, PR:L), needs the OOB-message race path (AC:H); a double unlock primarily crashes the kernel (A:H), with no confirmed confidentiality/integrity impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix double unlock in rxrpc_recvmsg()
Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages.
AnalysisAI
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a process able to create and use an AF_RXRPC socket and to reach the recvmsg() OOB-message handling path in rxrpc_recvmsg(); this in turn requires the rxrpc kernel module to be present/loadable, which in practice means the host runs or supports AFS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) is the automated, worst-case score the kernel CNA applies to almost all kernel CVEs and should not be taken at face value here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local, low-privileged user opens an AF_RXRPC socket and calls recvmsg() in a way that steers the kernel into the OOB-message branch of rxrpc_recvmsg(), causing the lock to be released twice; the resulting lock-state corruption panics the machine or opens a race that could be developed toward memory corruption. No public exploit is referenced, and building a reliable escalation from a double unlock would require non-trivial kernel exploitation work. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.40, 7.1.5, or 7.2-rc1 (or later), or apply your distribution's backport of stable commits 8cd8cf3052ff9a4b86b25734f610e4af03786d3 / 1297ae6aeebc3863cb437e42a1bc4cd6173e43d9 / a2f299b4d5510147fa8629a6aba2869bbcc88aea from https://git.kernel.org/stable/c/8cd8cf3052fff9a4b86b25734f610e4af03786d3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems to identify those running kernel versions 6.16 through 7.1.4 and prioritize by exposure to untrusted network traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today