CVE-2026-74435

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc<br /> <br /> rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the<br /> rxrpc_call.rx_dec_buffer is unallocated and assumes that upon<br /> successful return that rx_dec_buffer must be allocated.<br /> However, rxrpc_verify_data() does not request an allocation if<br /> the rxrpc_skb_priv.len is zero.<br /> <br /> In addition, failure to allocate rx_dec_buffer will result in a<br /> call to skb_copy_bits() with a NULL destination which can<br /> trigger a NULL pointer dereference.<br /> <br /> To prevent these issues rxrpc_verify_data() is modified to<br /> always attempt to allocate the rxrpc_call.rx_dec_buffer if it<br /> is NULL.<br /> <br /> This issue was identified with assistance of a private<br /> sashiko instance.