CVE-2026-45998: rxrpc: Fix potential UAF after skb_unshare() failure
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix potential UAF after skbunshare() failure
If skbunshare() fails to unshare a packet due to allocation failure in rxrpcinputpacket(), the skb pointer in the parent (rxrpciothread()) will be NULL'd out. This will likely cause the call to tracerxrpcrxdone() to oops.
Fix this by moving the unsharing down to where rxrpcinputcallevent() calls rxrpcinputcallpacket(). There are a number of places prior to that where we ignore DATA packets for a variety of reasons (such as the call already being complete) for which an unshare is then avoided.
And with that, rxrpcinputpacket() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What access and privileges does exploitation require?
The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. The impact is rated high for confidentiality, integrity, and availability.
Which products are identified as affected?
The listed affected software includes the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1.