CVE-2026-74436

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rxrpc: serialize kernel accept preallocation with socket teardown<br /> <br /> rxrpc_kernel_charge_accept() reads rx-&gt;backlog without any<br /> socket/backlog synchronization and passes that raw pointer into<br /> rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()<br /> sets rx-&gt;backlog = NULL and frees the backlog rings, so a kernel<br /> preallocation worker can keep using a freed struct rxrpc_backlog<br /> while updating *_backlog_head/tail and array slots.<br /> <br /> Serialize the state check and backlog lookup with the socket lock,<br /> and reject kernel preallocation once teardown has disabled<br /> listening or discarded the service backlog.