EUVD-2026-59583
GHSA-c43x-9gq9-q65m
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kernel-internal use-after-free won only by racing socket teardown, so AV:L/AC:H and PR:L for local access; impact is chiefly a crash (A:H) with limited, unproven C/I.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: serialize kernel accept preallocation with socket teardown
rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots.
Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.
AnalysisAI
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to actually use the rxrpc/AF_RXRPC transport (typically via the kAFS/AFS filesystem or another in-kernel RxRPC consumer) - on systems where the rxrpc module is never loaded there is no attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) appears to be an automated worst-case score that overstates real-world exploitability: this is a kernel-internal race between a preallocation worker and socket teardown, not a directly remote-triggerable memory-corruption primitive, so a more realistic vector is local with high attack complexity (winning a narrow race window) - verify against vendor before treating as remotely unauthenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host actively using kAFS/rxrpc, a local attacker (or a fault-injection workload) repeatedly opens, listens on, and tears down rxrpc service sockets while kernel accept preallocation is charging the backlog, aiming to win the race where rx->backlog is freed but still in use. Hitting the window corrupts freed kernel memory, most reliably crashing the kernel (DoS) and potentially enabling further memory manipulation. … |
| Remediation | Upgrade to a fixed stable kernel: Vendor-released patch 6.6.148, 6.12.101, 6.18.40, or 7.1.5 (mainline 7.2-rc1), or your distribution's equivalent backport containing the rxrpc serialization commits from git.kernel.org (0337cdba0c47 / dfa0b2bbc5e5 / 35a967ff8b24 / 1741378a7a83 / dc175389b18c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running vulnerable Linux kernel versions (prior to the fixed stable releases noted in vendor advisory) and conduct patch testing in a non-production AFS client environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today