What is the CVSS score of EUVD-2026-59578?

EUVD-2026-59578 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59578?

The Linux kernel's RxRPC subsystem contains a denial-of-service vulnerability (CVE-2026-74431) affecting AFS deployments.. A patch is available.

How to fix or mitigate EUVD-2026-59578?

Within 24 hours, identify all systems running Linux with RxRPC endpoints (primarily AFS clients and servers on systems running Linux through version 7.1.4 or 6.18.39) and assess their exposure using standard vulnerability scanning. Within 7 days, plan patch deployment by contacting your Linux distribution vendor (Red Hat, Ubuntu, SUSE, Debian, etc.) to obtain the latest security updates that address this vulnerability. Within 30 days, complete patch deployment to all identified systems, update to patched kernel versions, and validate that RxRPC-dependent services remain operational.

Linux Kernel EUVD-2026-59578

| CVE-2026-74431 HIGH

2026-08-15 Linux

GHSA-pvqf-593m-79fg

Denial Of Service Linux Red Hat

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote attacker sends packets over network without authentication; sole impact is availability via infinite loop in recvmsg wait condition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:19 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.5 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:59 cve.org

HIGH 7.5

CVE Published

Aug 15, 2026 - 05:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix potential infinite loop in rxrpc_recvmsg()

Fix the wait in rxrpc_recvmsg() also take check the oob queue.

AnalysisAI

Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify AFS/rxrpc endpoint on target

Delivery

Send crafted RxRPC packets to populate OOB queue

Exploit

Victim process calls recvmsg()

Execution

Wait loop in rxrpc_recvmsg() ignores OOB queue

Persist

Infinite loop hangs kernel thread

Impact

RxRPC and AFS services become unavailable

Access

Identify AFS/rxrpc endpoint on target

Delivery

Send crafted RxRPC packets to populate OOB queue

Exploit

Victim process calls recvmsg()

Execution

Wait loop in rxrpc_recvmsg() ignores OOB queue

Persist

Infinite loop hangs kernel thread

Impact

RxRPC and AFS services become unavailable

Vulnerability AssessmentAI

Exploitation	The target system must have the rxrpc kernel subsystem actively loaded and in use - this primarily means hosts running AFS (Andrew File System) clients (e.g., OpenAFS kAFS) or AFS servers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly classifies this as a remotely triggerable, unauthenticated DoS with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker with network access to a host running an rxrpc endpoint sends a sequence of crafted RxRPC packets designed to enqueue data into the kernel's OOB queue for an rxrpc socket. When the victim process calls recvmsg() and enters the wait loop in rxrpc_recvmsg(), the loop evaluates a condition that does not inspect the OOB queue, causing it to spin indefinitely rather than waking to deliver the queued data. …
Remediation	Upgrade to Linux 6.18.40 or 7.1.5 (or later), which contain the rxrpc_recvmsg() OOB queue wait-condition fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Linux with RxRPC endpoints (primarily AFS clients and servers on systems running Linux through version 7.1.4 or 6.18.39) and assess their exposure using standard vulnerability scanning. …

Threat intelligence, references, and detailed analysis are available after sign-in.