CVE-2026-74430

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rxrpc: Fix ACKALL packet handling<br /> <br /> rxrpc_input_ackall() accepts ACKALL packets without checking whether the<br /> call is in a state that can legitimately have outstanding transmit buffers.<br /> A forged ACKALL can therefore reach a new service call in<br /> RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.<br /> <br /> In that state call-&gt;tx_top is zero and call-&gt;tx_queue is NULL, so<br /> rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a<br /> null-pointer dereference.<br /> <br /> Fix the handling of ACKALL packets by the following means:<br /> <br /> (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates<br /> that the client call is connected, but nothing has been transmitted as<br /> yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything<br /> has been transmitted at least once, but we&amp;#39;re now waiting for the<br /> stuff remaining in the Tx buffer to be ACK&amp;#39;d (retransmissions may<br /> still happen).<br /> <br /> The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned<br /> a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the<br /> first packet is transmitted.<br /> <br /> RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate<br /> that all Tx packets have been ACK&amp;#39;d and we&amp;#39;re now waiting for the<br /> reply to be received.<br /> <br /> (2) As per Wyatt Feng&amp;#39;s original patch[1], the ACKALL handler then checks<br /> that the call state is one in which there might be stuff in the Tx<br /> buffer to ACK, but now this includes AWAIT_ACK rather than<br /> AWAIT_REPLY. ACKALL packets are ignored if received in the wrong<br /> state.<br /> <br /> Note that unlike Wyatt Feng&amp;#39;s patch, it&amp;#39;s no longer necessary to check<br /> to see if the Tx buffer exists as this the state set now covers this.<br /> <br /> (3) Make the ACKALL handler use call-&gt;tx_transmitted rather than<br /> call-&gt;tx_top as the former is explicitly the highest packet seq number<br /> transmitted, whereas the latter has a looser definition.<br /> <br /> Thanks to Jeffrey Altman for a description of the history of the ACKALL<br /> packet[1].