CVE-2026-74430 Linux CVE debrief

Who should care

Linux kernel developers and users, as well as security teams responsible for monitoring and patching Linux kernel vulnerabilities, should review and apply the provided patches to prevent potential null-pointer dereferences. They should also implement additional defensive measures to prevent similar attacks and monitor the Linux kernel for any similar vulnerabilities. Affected product deployments should be identified and owners assigned for follow-up. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets retested, with the item only closed after evidence is documented. Asset inventory and vulnerability management processes should be updated to reflect this vulnerability and ensure timely patching of affected systems. Security teams should also review the CVE record and NVD details to validate affected scope, severity, and vendor guidance. Rollback and change windows should be planned for updates or mitigations through normal change control where exposure is confirmed. Source tracking and monitoring should be implemented to detect similar vulnerabilities in the future. This list of recommended actions is not exhaustive, and additional measures may be necessary depending on the specific environment and risk tolerance. The priority of these actions should be determined based on the specific risk and exposure of each system. Linux distributions and maintainers should verify and apply patches according to their standard processes. Security teams should verify patch deployment and perform additional reviews as necessary. Linux kernel developers should review the code changes and ensure that similar vulnerabilities are addressed in the future. The Linux Foundation and other relevant organizations should also be notified to ensure that the vulnerability is properly handled and mitigated across the ecosystem. Security researchers should continue to monitor the Linux kernel for similar vulnerabilities and report any findings through responsible disclosure channels. The N

Technical summary

The rxrpc_input_ackall() function in the Linux kernel did not properly check the state of the call before processing ACKALL packets, leading to a potential null-pointer dereference. The vulnerability was resolved by adding two new call states and modifying the ACKALL handler to check the call state before processing ACKALL packets. This change ensures that ACKALL packets are only processed when the call is in a state that can legitimately have outstanding transmit buffers.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Monitor the Linux kernel for any similar vulnerabilities
• Implement additional defensive measures to prevent similar attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by adding two new call states, RXRPC_CALL_CLIENT_PRE_SEND and RXRPC_CALL_CLIENT_AWAIT_ACK, and modifying the ACKALL handler to check the call state before processing ACKALL packets. The rxrpc_input_ackall() function did not properly check the state of the call before processing ACKALL packets, leading to a potential null-pointer dereference. The CVE record was published on 2026-08-15T06:22:45.120Z and has not been modified since then. Limited source detail was provided, so evidence is limited to CVE and NVD information.

Official resources