In the Linux kernel, the following vulnerability has been resolved:
rxrpc: rxrpcverifydata ensure rxdecbuffer alloc
rxrpcrecvmsgdata() calls rxrpcverifydata() whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However, rxrpcverifydata() does not request an allocation if the rxrpcskb_priv.len is zero.
In addition, failure to allocate rxdecbuffer will result in a call to skbcopybits() with a NULL destination which can trigger a NULL pointer dereference.
To prevent these issues rxrpcverifydata() is modified to always attempt to allocate the rxrpccall.rxdec_buffer if it is NULL.
This issue was identified with assistance of a private sashiko instance.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74435.json"
}