External risk intelligence

Linux Kernel rxrpc Preallocation Race Condition

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74436

This vulnerability exists within the Linux kernel rxrpc implementation, which handles internal socket backlog synchronization. It is a low-level kernel code issue requiring local or specific socket-level interaction rather than a service or application that is commonly exposed directly to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability within the Linux kernel's rxrpc networking component. The issue involves a flaw in how kernel operations manage socket data, potentially leading to a critical system compromise if exploited. The main concern is to confirm if this specific kernel functionality is in use within our environment.

Flaw in kernel network data handling.
Matters for system integrity and remote control.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the Linux kernel's rxrpc functionality. This likely requires a specific network-based interaction that triggers a race condition between socket teardown and kernel preallocation processes. When successful, this could lead to a denial-of-service or potentially more severe system compromise.

Requires specific network interaction.
Triggers a race condition during socket teardown.
Risk of system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the internal management of kernel socket preallocation when a socket is being torn down. If synchronization issues occur, a kernel worker might attempt to use freed memory, potentially leading to system instability or unintended behavior.

Kernel socket backlog data.
Race condition during socket teardown.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's rxrpc component impacts systems using this network communication protocol. Infrastructure and platform teams are likely responsible for managing the kernel, and security teams should assess the exposure of affected systems. The first practical step is to identify any systems utilizing the affected kernel code, determine their business criticality, and then confirm the accountable owner to plan for remediation.

Infrastructure and platform teams own resolution.
Verify system criticality and exposure first.
Plan coordinated maintenance for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel rxrpc component?

The rxrpc component is a networking subsystem within the Linux kernel that implements the AF_RXRPC protocol. It is primarily used to handle remote procedure call services, allowing the kernel to manage communication backlogs and preallocate resources for incoming network requests efficiently.

What is the flaw in CVE-2026-74436?

This vulnerability is a race condition. It occurs because the kernel fails to synchronize the teardown of a socket with the preallocation of memory for new connections. Because these two processes happen simultaneously without proper locking, the kernel may attempt to use memory that has already been freed, leading to dangerous memory errors.

How can an attacker trigger this vulnerability?

An attacker must interact with a system using specific network-based requests that force the kernel to handle socket teardown and preallocation at the exact same time. It is important to note that merely sending standard network traffic to a service is generally insufficient; the timing must precisely align with the kernel's internal socket cleanup operations.

Is my system exposed to this Linux kernel issue?

According to Halo Surface Signal, this vulnerability is very unlikely to be exposed. While the bug is technically reachable via the network, it resides in low-level kernel code managing internal socket synchronization. It does not typically apply to standard public-facing applications, making it most relevant to specialized systems using the rxrpc protocol.

Do I need to update my servers immediately?

Your first step is to confirm if your infrastructure actually utilizes the rxrpc protocol. You should coordinate with platform teams to inventory your systems, identify which ones use this specific kernel functionality, and assess their business criticality before planning any maintenance or kernel updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.