External risk intelligence

Linux Kernel rxrpc Double Unlock Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74428

This vulnerability exists in the rxrpc protocol implementation within the Linux kernel. While it handles network traffic, it is a low-level kernel component rather than an internet-facing service or application. It is not typically exposed directly to the public internet in common deployment patterns.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in the Linux kernel's rxrpc protocol implementation, specifically concerning message handling. This issue has been resolved. The main concern is confirming relevance and exposure.

Kernel message handling flaw resolved.
Affects core operating system network functions.
Confirm relevance and exposure to systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted network messages to a system running a vulnerable Linux kernel. The rxrpc protocol, which handles certain network communications, has a flaw in how it manages memory during the processing of out-of-band messages. Successfully triggering this flaw could lead to a system crash or allow an attacker to potentially gain elevated privileges.

No special access or authentication needed.
Malicious network messages trigger the flaw.
Can lead to crashes or privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A double unlock in the Linux kernel's rxrpc_recvmsg() function could allow an attacker to cause unintended system behavior or potentially crash the system. This occurs when handling out-of-band messages, which are messages that arrive outside the expected sequence. The advisory does not specify what system data, user data, or sensitive information could be affected.

System stability could be impacted.
Out-of-band messages may trigger the flaw.
Potential for denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's rxrpc module requires attention from teams responsible for kernel maintenance and system security. The immediate priority is to identify all systems running the affected kernel version, assess their exposure, and confirm the business criticality of those systems. Once ownership is established, a remediation plan, potentially involving kernel updates or relevant mitigations, can be developed based on risk.

Kernel and security teams own this.
Verify system reachability and criticality.
Plan kernel updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel rxrpc module?

The rxrpc module is a component within the Linux kernel that implements the Reliable User-space RPC protocol. It is used to facilitate network communications for specific services that rely on this protocol for data exchange. Because it operates at the kernel level, it manages low-level data processing tasks, including how the system interprets incoming network messages.

What does the CVE-2026-74428 double unlock mean?

A double unlock is a type of synchronization error where a program attempts to release a lock that has already been released. In the context of CVE-2026-74428, this flaw exists in the rxrpc_recvmsg function. This logic error can disrupt the kernel's internal memory management, potentially leading to system instability or allowing an attacker to gain unauthorized privileges.

How is the rxrpc_recvmsg flaw triggered?

This vulnerability is triggered when the kernel processes specific, malformed out-of-band network messages. It is not triggered by standard, well-formed network traffic. An attacker must send these specially crafted packets to a system running a vulnerable kernel to attempt to exploit the flawed message handling logic.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for most environments. While the flaw resides in a network-handling component, rxrpc is a low-level kernel protocol and is generally not exposed directly to the public internet. Systems are typically only at risk if they are specifically configured to expose this protocol to external network traffic.

How should I respond to CVE-2026-74428?

First, identify all systems in your environment that are running a version of the Linux kernel containing this rxrpc component. Once identified, evaluate the network accessibility of these systems to determine if they are reachable by untrusted sources. Coordinate with your kernel maintenance team to prioritize and apply the necessary kernel updates that resolve this synchronization flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.