CVE-2026-74435: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: rxrpcverifydata ensure rxdecbuffer alloc
rxrpcrecvmsgdata() calls rxrpcverifydata() whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However, rxrpcverifydata() does not request an allocation if the rxrpcskbpriv.len is zero.
In addition, failure to allocate rxdecbuffer will result in a call to skbcopybits() with a NULL destination which can trigger a NULL pointer dereference.
To prevent these issues rxrpcverifydata() is modified to always attempt to allocate the rxrpccall.rxdecbuffer if it is NULL.
This issue was identified with assistance of a private sashiko instance.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify rxrpc_verify_data() so it always attempts to allocate rxrpc_call.rx_dec_buffer if it is NULL (to prevent NULL pointer dereference when rxrpc_recvmsg_data() calls rxrpc_verify_data() and rxrpc_skb_priv.len is zero).
Linux kernel (rxrpc) rxrpc_verify_data() behavior for rxrpc_call.rx_dec_buffer allocation = Always attempt to allocate rxrpc_call.rx_dec_buffer when rxrpc_call.rx_dec_buffer is NULL