{"apiVersion":"1.0","identifier":"CVE-2026-74434","description":"In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don-t move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto pending_oobq always runs. As a result, reading a challenge with MSG_PEEK leaves the skb on recvmsg_oobq while also adding it to pending_oobq. Since struct sk_buff-s rbnode shares storage with its next and prev pointers, rb_insert_color() overwrites the list linkage, and the skb, which holds a single reference, becomes reachable from both queues at once. When the socket is closed both queues are drained in turn. While draining recvmsg_oobq, __skb_unlink() follows the next and prev pointers that rbnode has overwritten and writes to a bad address. Also, as the skb holds a single reference but is freed from each queue, both the skb and the connection reference it holds are released twice. This leads to memory corruption and to a use-after-free caused by the connection refcount underflow. MSG_PEEK does not consume the message from the queue, so only unlink it from recvmsg_oobq and then move it onto pending_oobq or free it when the message is actually consumed.","publishedAt":"2026-08-15T06:22:45","lastModifiedAt":"2026-08-17T06:19:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74434","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00337,"riskScore":1.01,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74434","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74434","en":"https://www.redsauce.net/en/cves/CVE-2026-74434","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74434","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74434","de":"https://www.redsauce.net/de/cves/CVE-2026-74434","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74434","el":"https://www.redsauce.net/el/cves/CVE-2026-74434"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74434"}}